Medium severity6.5NVD Advisory· Published Jan 22, 2019· Updated Jun 17, 2026
CVE-2017-6922
CVE-2017-6922
Description
In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
drupal/corePackagist | >= 7.0, < 7.56 | 7.56 |
drupal/corePackagist | >= 8.0, < 8.3.4 | 8.3.4 |
drupal/drupalPackagist | >= 8.0, < 8.3.4 | 8.3.4 |
drupal/drupalPackagist | >= 7.0, < 7.56 | 7.56 |
Affected products
6- ghsa-coords2 versions
>= 7.0, < 7.56+ 1 more
- (no CPE)range: >= 7.0, < 7.56
- (no CPE)range: >= 8.0, < 8.3.4
- Range: Drupal 8
Patches
Vulnerability mechanics
References
9- www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiplenvdPatchVendor AdvisoryWEB
- www.securityfocus.com/bid/99219nvdThird Party AdvisoryVDB EntryWEB
- www.securitytracker.com/id/1038781nvdThird Party AdvisoryVDB EntryWEB
- github.com/advisories/GHSA-58f3-cx8p-h8jgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-6922ghsaADVISORY
- www.debian.org/security/2017/dsa-3897nvdThird Party AdvisoryWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6922.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6922.yamlghsaWEB
- www.drupal.org/SA-CORE-2017-003ghsaWEB
News mentions
0No linked articles in our index yet.