PT-2017-17024 · Drupal · Drupal

Casey · Published 2017-03-16 · Updated 2022-05-13 · CVE-2017-6377

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 8.2.x before 8.2.7

Description The issue arises when adding a private file via the editor, where the editor fails to correctly check access for the attached file, leading to an access bypass.

Recommendations For versions 8.2.x before 8.2.7, update to version 8.2.7 or later to resolve the issue.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2017-6377

GHSA-W7QX-VWR9-2J3R

Affected Products

Drupal

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6377.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6377.yaml · Exploit
• https://drupal.org/SA-2017-001 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w7qx-vwr9-2j3r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6377 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6377 · Vendor Advisory
• https://github.com/drupal/drupal · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6377 · Note
• http://securityfocus.com/bid/96919 · Note
• http://securitytracker.com/id/1038058 · Note