CVE-2017-6928

Low

Low Medium High Critical

CVSS Score

Published: Mar 01, 2018

Last Modified: Nov 21, 2024

Vulnerability Description

Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying to grant access to the file and another is trying to deny it, leading to an access bypass vulnerability. This vulnerability is mitigated by the fact that it only occurs for unusual site configurations.

Known Affected Software

55 configuration(s) from 2 vendor(s)

debian_linux

Version:

8.0

CPE:

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

debian_linux

Version:

7.0

CPE:

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

debian_linux

Version:

9.0

CPE:

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

drupal

Version:

7.53

CPE:

cpe:2.3:a:drupal:drupal:7.53:*:*:*:*:*:*:*

drupal

Version:

7.38

CPE:

cpe:2.3:a:drupal:drupal:7.38:*:*:*:*:*:*:*

drupal

Version:

7.26

CPE:

cpe:2.3:a:drupal:drupal:7.26:*:*:*:*:*:*:*

drupal

Version:

7.9

CPE:

cpe:2.3:a:drupal:drupal:7.9:*:*:*:*:*:*:*

drupal

Version:

7.5

CPE:

cpe:2.3:a:drupal:drupal:7.5:*:*:*:*:*:*:*

drupal

Version:

7.3

CPE:

cpe:2.3:a:drupal:drupal:7.3:*:*:*:*:*:*:*

drupal

Version:

7.32

CPE:

cpe:2.3:a:drupal:drupal:7.32:*:*:*:*:*:*:*

drupal

Version:

7.24

CPE:

cpe:2.3:a:drupal:drupal:7.24:*:*:*:*:*:*:*

drupal

Version:

7.41

CPE:

cpe:2.3:a:drupal:drupal:7.41:*:*:*:*:*:*:*

drupal

Version:

7.42

CPE:

cpe:2.3:a:drupal:drupal:7.42:*:*:*:*:*:*:*

drupal

Version:

7.4

CPE:

cpe:2.3:a:drupal:drupal:7.4:*:*:*:*:*:*:*

drupal

Version:

7.11

CPE:

cpe:2.3:a:drupal:drupal:7.11:*:*:*:*:*:*:*

drupal

Version:

7.0

CPE:

cpe:2.3:a:drupal:drupal:7.0:beta1:*:*:*:*:*:*

drupal

Version:

7.21

CPE:

cpe:2.3:a:drupal:drupal:7.21:*:*:*:*:*:*:*

drupal

Version:

7.27

CPE:

cpe:2.3:a:drupal:drupal:7.27:*:*:*:*:*:*:*

drupal

Version:

7.50

CPE:

cpe:2.3:a:drupal:drupal:7.50:*:*:*:*:*:*:*

drupal

Version:

7.44

CPE:

cpe:2.3:a:drupal:drupal:7.44:*:*:*:*:*:*:*

drupal

Version:

7.51

CPE:

cpe:2.3:a:drupal:drupal:7.51:*:*:*:*:*:*:*

drupal

Version:

7.23

CPE:

cpe:2.3:a:drupal:drupal:7.23:*:*:*:*:*:*:*

drupal

Version:

7.35

CPE:

cpe:2.3:a:drupal:drupal:7.35:*:*:*:*:*:*:*

drupal

Version:

7.56

CPE:

cpe:2.3:a:drupal:drupal:7.56:*:*:*:*:*:*:*

drupal

Version:

7.8

CPE:

cpe:2.3:a:drupal:drupal:7.8:*:*:*:*:*:*:*

drupal

Version:

7.43

CPE:

cpe:2.3:a:drupal:drupal:7.43:*:*:*:*:*:*:*

drupal

Version:

7.7

CPE:

cpe:2.3:a:drupal:drupal:7.7:*:*:*:*:*:*:*

drupal

Version:

7.36

CPE:

cpe:2.3:a:drupal:drupal:7.36:*:*:*:*:*:*:*

drupal

Version:

7.10

CPE:

cpe:2.3:a:drupal:drupal:7.10:*:*:*:*:*:*:*

drupal

Version:

7.33

CPE:

cpe:2.3:a:drupal:drupal:7.33:*:*:*:*:*:*:*

drupal

Version:

7.52

CPE:

cpe:2.3:a:drupal:drupal:7.52:*:*:*:*:*:*:*

drupal

Version:

7.2

CPE:

cpe:2.3:a:drupal:drupal:7.2:*:*:*:*:*:*:*

drupal

Version:

7.39

CPE:

cpe:2.3:a:drupal:drupal:7.39:*:*:*:*:*:*:*

drupal

Version:

7.29

CPE:

cpe:2.3:a:drupal:drupal:7.29:*:*:*:*:*:*:*

drupal

Version:

7.54

CPE:

cpe:2.3:a:drupal:drupal:7.54:*:*:*:*:*:*:*

drupal

Version:

7.15

CPE:

cpe:2.3:a:drupal:drupal:7.15:*:*:*:*:*:*:*

drupal

Version:

7.22

CPE:

cpe:2.3:a:drupal:drupal:7.22:*:*:*:*:*:*:*

drupal

Version:

7.25

CPE:

cpe:2.3:a:drupal:drupal:7.25:*:*:*:*:*:*:*

drupal

Version:

7.34

CPE:

cpe:2.3:a:drupal:drupal:7.34:*:*:*:*:*:*:*

drupal

Version:

7.28

CPE:

cpe:2.3:a:drupal:drupal:7.28:*:*:*:*:*:*:*

drupal

Version:

7.16

CPE:

cpe:2.3:a:drupal:drupal:7.16:*:*:*:*:*:*:*

drupal

Version:

7.1

CPE:

cpe:2.3:a:drupal:drupal:7.1:*:*:*:*:*:*:*

drupal

Version:

7.30

CPE:

cpe:2.3:a:drupal:drupal:7.30:*:*:*:*:*:*:*

drupal

Version:

7.13

CPE:

cpe:2.3:a:drupal:drupal:7.13:*:*:*:*:*:*:*

drupal

Version:

7.14

CPE:

cpe:2.3:a:drupal:drupal:7.14:*:*:*:*:*:*:*

drupal

Version:

7.31

CPE:

cpe:2.3:a:drupal:drupal:7.31:*:*:*:*:*:*:*

drupal

Version:

7.37

CPE:

cpe:2.3:a:drupal:drupal:7.37:*:*:*:*:*:*:*

drupal

Version:

7.17

CPE:

cpe:2.3:a:drupal:drupal:7.17:*:*:*:*:*:*:*

drupal

Version:

7.19

CPE:

cpe:2.3:a:drupal:drupal:7.19:*:*:*:*:*:*:*

drupal

Version:

7.12

CPE:

cpe:2.3:a:drupal:drupal:7.12:*:*:*:*:*:*:*

drupal

Version:

7.55

CPE:

cpe:2.3:a:drupal:drupal:7.55:*:*:*:*:*:*:*

drupal

Version:

7.20

CPE:

cpe:2.3:a:drupal:drupal:7.20:*:*:*:*:*:*:*

drupal

Version:

7.18

CPE:

cpe:2.3:a:drupal:drupal:7.18:*:*:*:*:*:*:*

drupal

Version:

7.40

CPE:

cpe:2.3:a:drupal:drupal:7.40:*:*:*:*:*:*:*

drupal

Version:

7.6

CPE:

cpe:2.3:a:drupal:drupal:7.6:*:*:*:*:*:*:*

This vulnerability affects 55 software configuration(s). Ensure you patch all affected systems.

References & Resources

Severity Details

out of 10.0

Low

Weakness Type (CWE)

CWE-732

Incorrect Permission Assignment for Critical Resource

Description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Exploit Likelihood: High
Typical Severity: High
Abstraction Level: Class