Drupal Data Manipulation vulnerability

Last Update Date: 12 Oct 2016 10:18 Release Date: 12 Oct 2016 2609 Views

RISK: High Risk

TYPE: Servers - Other Servers

A vulnerability was identified on Drupal, a remote attacker can exploit this vulnerability to upload file to the targeted system. The uploaded file will be publicly accessible.

Impact

Data Manipulation

System / Technologies affected

Version: 7.x, 8.x

Solutions

Note: No patch is currently available.

Workaround:

1. Configure anonymous can only upload files to the private file system.
2. Ensure cron is properly running on the site.
3. Only authenticated user can upload content.
4. Audit your public file system periodically.

Vulnerability Identifier

No CVE information is available

Source

AusCERT