PT-2017-17026

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 8.2.2 Description A third-party development library included with Drupal 8 development dependencies is susceptible to remote code execution. However, this issue is mitigated by the default .htaccess protection against...

CVE-2017-6379: Cross-Site Request Forgery (CSRF)

Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID...

CVE-2017-6377: Incorrect Authorization

When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass...

CVE-2017-6381: Inclusion of Functionality from Untrusted Control Sphere

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerabl...

Drupal Password Reset Landing Page Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Password Reset Landing Page Module is a password reset page module. An access bypass vulnerability exists in the Drupal Password Reset Landing Page Module. This vulnerability can be...

PT-2017-17024

Name of the Vulnerable Software and Affected Versions Drupal versions 8.2.x before 8.2.7 Description The issue arises when adding a private file via the editor, where the editor fails to correctly check access for the attached file, leading to an access bypass. Recommendations For versions 8.2.x...

PT-2017-17025

Name of the Vulnerable Software and Affected Versions Drupal versions 8.2.x before 8.2.7 Description The issue affects some administrative paths that did not include protection for CSRF, allowing an attacker to disable certain blocks on a site. This is mitigated by the requirement for an attacker...

Some admin paths were not protected with a CSRF token

More info at https://www.drupal.org/SA-2017-001...

Editor module incorrectly checks access to inline private files

More info at https://www.drupal.org/SA-2017-001...

Editor module incorrectly checks access to inline private files

More info at https://www.drupal.org/SA-2017-001...

Some admin paths were not protected with a CSRF token

More info at https://www.drupal.org/SA-2017-001...

Remote code execution

More info at https://www.drupal.org/SA-2017-001...

Remote code execution

More info at https://www.drupal.org/SA-2017-001...

Drupal Releases Security Update

Drupal has released an advisory to address vulnerabilities in Drupal core 8.x versions prior to 8.2.7. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review Drupal's Security Advisory and apply th...

Private - Critical - Access bypass - DRUPAL-SA-CONTRIB-2017-031

This module enables you to mark nodes as private so that they are only accessible to users that have been granted an extra permissions. The module doesn't always enforce the access restrictions. In some cases a node that a site admin expects to be private is actually accessible as normal or nodes...

Drupal 7.x Services module unserialize() to RCE

Upon auditing Drupal's Services module, the Ambionics team came accross an insecure use of unserialize. The exploitation of the vulnerability allowed for privilege escalation, SQL injection and, finally, remote code execution. Services module Services is a "standardized solution for building API'...

[SECURITY] Fedora 25 Update: drupal7-views-3.15-1.fc25

You need Views if: You like the default front page view, but you find you want to sort it differently. You like the default taxonomy/term view, but you find you want to sort it differently; for example, alphabetically. You use /tracker, but you want to restrict it to posts of a certain type. You...

[SECURITY] Fedora 24 Update: drupal7-views-3.15-1.fc24

You need Views if: You like the default front page view, but you find you want to sort it differently. You like the default taxonomy/term view, but you find you want to sort it differently; for example, alphabetically. You use /tracker, but you want to restrict it to posts of a certain type. You...

Drupal 7.x Module Services - Remote Code Execution

Drupal 7.x Module Services - Remote Code Execution Exploit Title: Drupal 7.x Services Module Remote Code Execution Vendor Homepage: https://www.drupal.org/project/services Exploit Author: Charles FOL Contact: https://twitter.com/ambionics Website:...

Drupal 7.x Module Services - Remote Code Execution

Exploit Title: Drupal 7.x Services Module Remote Code Execution Vendor Homepage: https://www.drupal.org/project/services Exploit Author: Charles FOL Contact: https://twitter.com/ambionics Website: https://www.ambionics.io/blog/drupal-services-module-rce !/usr/bin/php 'dixuSOspsOUU.php', 'data' = ...