PT-2017-17416 · Drupal · Drupal

Samuel Mortenson · Publicado 2017-04-20 · Atualizado 2022-05-13 · CVE-2017-6919

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal 8 versions prior to 8.2.8 Drupal 8.3 versions prior to 8.3.1

Description The issue allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.

Recommendations For Drupal 8 versions prior to 8.2.8, update to version 8.2.8 or later. For Drupal 8.3 versions prior to 8.3.1, update to version 8.3.1 or later.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2017-6919

GHSA-6HPJ-9XJ7-2JXX

Produtos afetados

Drupal

Referências · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6919.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6919.yaml · Exploit
• https://github.com/drupal/core · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6919 · Nota de Segurança
• https://drupal.org/SA-CORE-2017-002 · Aviso do Fabricante
• https://drupal.org/SA-2017-002 · Nota
• http://securityfocus.com/bid/97941 · Nota
• https://osv.dev/vulnerability/CVE-2017-6919 · Aviso do Fabricante
• http://securitytracker.com/id/1038371 · Nota
• https://osv.dev/vulnerability/GHSA-6hpj-9xj7-2jxx · Aviso do Fabricante