CVE-2017-6922: debian debian_linux
Vulnerability summary
CVE-2017-6922 is a medium (CVSS 6.5) vulnerability in debian debian_linux. EPSS estimates a 1.95% chance of exploitation in the next 30 days, higher than 79.9% of scored vulnerabilities.
Timeline
- 22-01-2019PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.95%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
0.00 pp
From 1.95% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- drupal7< 7.32-1+deb8u9 | < 7.52-2+deb9u1 | < 7.14-2+deb7u16
- debian_linuxEOL8.0 | 9.0
Drupal2 products
- drupal≥ 7.0, < 7.56 | ≥ 8.0.0, < 8.3.4
- drupal core≥ Drupal 8, < 8.3.3 | ≥ Drupal 7, < 7.55
Mageia1 product
- drupal< 7.56-1.mga5
Ubuntu1 product
- drupal7All versions (No fix recorded)
4 vendors · 6 products
References
14 links
- www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multipleX Refsource CONFIRMPatchVendor Advisory