CVE-2017-6377

CVE-2017-6377 affects Drupal 8.2.x prior to 8.2.7. The editor module fails to properly check access when attaching private files, causing an access bypass. Documents reference the Drupal editor access issue (SA-2017-001) and multiple advisories; affected versions are Drupal 8.x before 8.2.7. Reme...

CVE-2017-6379

CVE-2017-6379 concerns Drupal 8.x: admin paths in 8.2.x prior to 8.2.7 lacked CSRF protection, allowing an attacker to disable some blocks on a site. The issue is mitigated by the requirement that an attacker know the block ID. Connected sources (DRUPAL GHSA/NVD records) corroborate that this is ...

CVE-2017-6381

CVE-2017-6381 corresponds to a Drupal RCE via the PHPUnit component bundled with Drupal 8 development dependencies. Affected if running Drupal versions before 8.2.2; mitigation in the public description notes that .htaccess generally blocks PHP execution and that Composer development dependencies...

CVE-2017-6377

When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass...

Drupal Services module remote code execution vulnerability (CNVD-2017-03557)

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Services is one of the modules that allows users to programmatically create customized Web service items. A remote code execution vulnerability exists in the Services module of Drupal. ...

Drupal Password Reset Landing Page Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Password Reset Landing Page Module is a password reset page module. An access bypass vulnerability exists in the Drupal Password Reset Landing Page Module. This vulnerability can be...

Some admin paths were not protected with a CSRF token

More info at https://www.drupal.org/SA-2017-001...

Editor module incorrectly checks access to inline private files

More info at https://www.drupal.org/SA-2017-001...

Editor module incorrectly checks access to inline private files

More info at https://www.drupal.org/SA-2017-001...

Remote code execution

More info at https://www.drupal.org/SA-2017-001...

Remote code execution

More info at https://www.drupal.org/SA-2017-001...

Some admin paths were not protected with a CSRF token

More info at https://www.drupal.org/SA-2017-001...

Private - Critical - Access bypass - DRUPAL-SA-CONTRIB-2017-031

This module enables you to mark nodes as private so that they are only accessible to users that have been granted an extra permissions. The module doesn't always enforce the access restrictions. In some cases a node that a site admin expects to be private is actually accessible as normal or nodes...

Drupal Releases Security Update

Drupal has released an advisory to address vulnerabilities in Drupal core 8.x versions prior to 8.2.7. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review Drupal's Security Advisory and apply th...

drupal8 -- multiple vulnerabilities

Drupal Security Team reports: CVE-2017-6377: Editor module incorrectly checks access to inline private files CVE-2017-6379: Some admin paths were not protected with a CSRF token CVE-2017-6381: Remote code execution...

Drupal 7.x Services module unserialize() to RCE

Upon auditing Drupal's Services module, the Ambionics team came accross an insecure use of unserialize. The exploitation of the vulnerability allowed for privilege escalation, SQL injection and, finally, remote code execution. Services module Services is a "standardized solution for building API'...

[SECURITY] Fedora 25 Update: drupal7-views-3.15-1.fc25

You need Views if: You like the default front page view, but you find you want to sort it differently. You like the default taxonomy/term view, but you find you want to sort it differently; for example, alphabetically. You use /tracker, but you want to restrict it to posts of a certain type. You...

[SECURITY] Fedora 24 Update: drupal7-views-3.15-1.fc24

You need Views if: You like the default front page view, but you find you want to sort it differently. You like the default taxonomy/term view, but you find you want to sort it differently; for example, alphabetically. You use /tracker, but you want to restrict it to posts of a certain type. You...

Drupal 7.x Module Services - Remote Code Execution

Exploit Title: Drupal 7.x Services Module Remote Code Execution Vendor Homepage: https://www.drupal.org/project/services Exploit Author: Charles FOL Contact: https://twitter.com/ambionics Website: https://www.ambionics.io/blog/drupal-services-module-rce !/usr/bin/php 'dixuSOspsOUU.php', 'data' = ...

Drupal 7.x Module Services - Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Drupal 7.x Services Module Remote Code Execution Vendor Homepage: https://www.drupal.org/project/services Exploit Author: Charles FOL Contact: https://twitter.com/ambionics Website:...