Vulnerability CVE-2015-6659 - CERT Civis.Net

Vulnerability Name:

CVE-2015-6659 (CCN-105845)

Assigned:

2015-08-19

Published:

2015-08-19

Updated:

2016-12-24

Summary:

SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.

CVSS v3 Severity:

6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

6.4 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Data Manipulation

References:

Source: MITRE
Type: CNA
CVE-2015-6659

Source: FEDORA
Type: UNKNOWN
FEDORA-2015-13915

Source: FEDORA
Type: UNKNOWN
FEDORA-2015-14444

Source: FEDORA
Type: UNKNOWN
FEDORA-2015-13916

Source: FEDORA
Type: UNKNOWN
FEDORA-2015-14442

Source: FEDORA
Type: UNKNOWN
FEDORA-2015-13917

Source: FEDORA
Type: UNKNOWN
FEDORA-2015-14443

Source: CCN
Type: SECTRACK ID: 1033358
Drupal Multiple Flaws Let Remote Users Conduct Cross-Site Scripting and Cross-Site Request Forgery Attacks and Remote Authenticated Users Inject SQL Commands and Obtain Potentially Sensitive Information

Source: DEBIAN
Type: UNKNOWN
DSA-3346

Source: BID
Type: UNKNOWN
76432

Source: SECTRACK
Type: UNKNOWN
1033358

Source: XF
Type: UNKNOWN
drupal-databaseapi-sql-injection(105845)

Source: CCN
Type: DRUPAL-SA-CORE-2015-003
Drupal Core - Critical - Multiple Vulnerabilities

Source: CONFIRM
Type: Patch, Vendor Advisory
https://www.drupal.org/SA-CORE-2015-003

Vulnerable Configuration:

Configuration 1:

cpe:/a:drupal:drupal:7.0:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:alpha1:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:alpha2:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:alpha3:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:alpha4:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:alpha5:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:alpha6:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:alpha7:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:beta1:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:beta2:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:beta3:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:dev:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:rc1:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:rc2:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:rc3:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:rc4:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.1:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.2:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.3:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.4:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.5:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.6:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.7:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.8:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.9:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.10:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.11:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.12:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.13:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.14:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.15:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.16:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.17:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.18:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.19:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.20:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.21:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.22:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.23:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.24:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.25:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.26:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.27:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.28:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.29:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.30:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.33:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.34:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.35:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.36:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.37:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.38:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.x-dev:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:drupal:drupal:7.38:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.cisecurity:def:135	P	DSA-3346-1 -- drupal7 -- security update	2016-02-08
oval:com.ubuntu.artful:def:20156659000	V	CVE-2015-6659 on Ubuntu 17.10 (artful) - medium.	2015-08-24
oval:com.ubuntu.precise:def:20156659000	V	CVE-2015-6659 on Ubuntu 12.04 LTS (precise) - medium.	2015-08-24
oval:com.ubuntu.xenial:def:201566590000000	V	CVE-2015-6659 on Ubuntu 16.04 LTS (xenial) - medium.	2015-08-24
oval:com.ubuntu.trusty:def:20156659000	V	CVE-2015-6659 on Ubuntu 14.04 LTS (trusty) - medium.	2015-08-24
oval:com.ubuntu.xenial:def:20156659000	V	CVE-2015-6659 on Ubuntu 16.04 LTS (xenial) - medium.	2015-08-24