Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can upload a malicious file on Drupal Storage API, in
order for example to upload a Trojan.

Impacted products: Drupal Modules

Severity: 1/4

Creation date: 31/07/2014

DESCRIPTION OF THE VULNERABILITY

The Storage API module can be installed on Drupal.

This module manages uploads to the server. However, it uses for
the Apache server that hosts Drupal, an obsolete configuration
that does not prevent use of the uploaded file as executable code.

An attacker can therefore upload a malicious file on Drupal
Storage API, in order for example to upload a Trojan.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/Drupal-Storage-API-unsafe-configuration-15113