PT-2017-17416 · Drupal · Drupal

Samuel Mortenson · Published 2017-04-20 · Updated 2022-05-13 · CVE-2017-6919

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal 8 versions prior to 8.2.8 Drupal 8.3 versions prior to 8.3.1

Description The issue allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.

Recommendations For Drupal 8 versions prior to 8.2.8, update to version 8.2.8 or later. For Drupal 8.3 versions prior to 8.3.1, update to version 8.3.1 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2017-6919

GHSA-6HPJ-9XJ7-2JXX

Affected Products

Drupal

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6919.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6919.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-6919 · Security Note
• https://drupal.org/SA-CORE-2017-002 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6919 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6hpj-9xj7-2jxx · Vendor Advisory
• https://github.com/drupal/core · Note
• https://drupal.org/SA-2017-002 · Note
• http://securityfocus.com/bid/97941 · Note
• http://securitytracker.com/id/1038371 · Note