According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.67, 8.7.x prior to 8.6.16, or 8.7.x prior to 8.7.1. It is, therefore, affected by a path traversal vulnerability. This security release fixes third-party dependencies included in or required by Drupal core.
As described in TYPO3-PSA-2019-007: By-passing protection of Phar Stream Wrapper Interceptor: In order to intercept file invocations like file_exists or stat on compromised Phar archives the base name has to be determined and checked before allowing to be handled by PHP Phar stream handling. The current implementation is vulnerable to path traversal leading to scenarios where the Phar archive to be assessed is not the actual (compromised) file. (SA-CORE-2019-007)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- https://www.drupal.org/project/drupal/releases/7.67

  -     [SA-CORE-2019-007](https://www.drupal.org/SA-CORE-2019-0     07)     ([CVE-2019-11831](https://nvd.nist.gov/vuln/detail/CVE-2     019-11831))

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

-     [3.1.1](https://github.com/TYPO3/phar-stream-wrapper/rel     eases/tag/v3.1.1)

  -     [TYPO3-PSA-2019-007](https://typo3.org/security/advisory     /typo3-psa-2019-007/) /     [CVE-2019-11831](https://nvd.nist.gov/vuln/detail/CVE-20     19-11831)

  -     [TYPO3-PSA-2019-008](https://typo3.org/security/advisory     /typo3-psa-2019-008/) /     [CVE-2019-11830](https://nvd.nist.gov/vuln/detail/CVE-20     19-11830)

  -     [3.1.0](https://github.com/TYPO3/phar-stream-wrapper/rel     eases/tag/v3.1.0)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several security vulnerabilities have been discovered in drupal7, a PHP website platform. The vulnerabilities affect the embedded versions of the jQuery JavaScript library and the Typo3 Phar Stream Wrapper library.

CVE-2019-11358

It was discovered that the jQuery version embedded in Drupal was prone to a cross site scripting vulnerability in jQuery.extend().

For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2019-006.

CVE-2019-11831

It was discovered that incomplete validation in a Phar processing library embedded in Drupal, a fully-featured content management framework, could result in information disclosure.

For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2019-007.

For Debian 8 'Jessie', these problems have been fixed in version 7.32-1+deb8u17.

We recommend that you upgrade your drupal7 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
124698	Drupal 7.0.x < 7.67 / 8.6.x < 8.6.16 / 8.7.x < 8.7.1 Drupal Vulnerability (SA-CORE-2019-007)	Nessus	CGI abuses	2019/5/8	2022/4/11	critical
125418	Fedora 29 : drupal7 (2019-040857fd75)	Nessus	Fedora Local Security Checks	2019/5/28	2024/5/20	critical
125425	Fedora 28 : drupal7 (2019-41d6ffd6f0)	Nessus	Fedora Local Security Checks	2019/5/28	2024/5/20	critical
125233	Fedora 29 : php-typo3-phar-stream-wrapper (2019-d5f883429d)	Nessus	Fedora Local Security Checks	2019/5/17	2024/5/22	critical
125298	Debian DLA-1797-1 : drupal7 security update	Nessus	Debian Local Security Checks	2019/5/21	2024/5/21	critical

检测

插件搜索

critical

critical

critical

critical

critical