CVE-2017-6931: Malicious File Upload
In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for. If you have implemented a Settings Tray form in contrib or a custom module, the correct access checks should be added. This release fixes the only two implementations in core, but does not harden against other such bypasses. This vulnerability can be mitigated by disabling the Settings Tray module.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6931?
CVE-2017-6931 has a moderate severity rating as it allows unauthorized users to update certain data due to insufficient permission checks.
How do I fix CVE-2017-6931?
To fix CVE-2017-6931, you should update your Drupal version to 8.4.5 or later.
Which versions of Drupal are affected by CVE-2017-6931?
CVE-2017-6931 affects Drupal versions from 8.0 up to and including 8.4.4.
Is the Settings Tray module vulnerable in all configurations?
The Settings Tray module is vulnerable if implemented in contributed or custom modules without proper access checks.
What should I do if I cannot update my Drupal version for CVE-2017-6931?
If unable to update, implement strict access checks in your custom code to mitigate the risk of CVE-2017-6931.