CVE-2017-6922

Priority
Description
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56;
Private files that have been uploaded by an anonymous user but not
permanently attached to content on the site should only be visible to the
anonymous user that uploaded them, rather than all anonymous users. Drupal
core did not previously provide this protection, allowing an access bypass
vulnerability to occur. This issue is mitigated by the fact that in order
to be affected, the site must allow anonymous users to upload files into a
private file system.
Notes
Package
Upstream:released (7.56-1)
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE (trusty was needed)
Ubuntu 16.04 LTS (Xenial Xerus):needed
Ubuntu 18.04 LTS (Bionic Beaver):DNE
Ubuntu 20.04 LTS (Focal Fossa):DNE
Ubuntu 20.10 (Groovy Gorilla):DNE
Patches:
Upstream:http://cgit.drupalcode.org/drupal/diff/?h=7.x&id=600c1346ed976e6f35fc2b0f907a7837f0f7c145&id2=9eebe462d1e93e785e6c028dc6cf689623c4d936
More Information

Updated: 2020-07-28 18:45:49 UTC (commit 7b6828437fde0509248708fcdb5b0f7587b85bd1)