GitHub Advisoryadvisory · Packagist

GHSA-6hpj-9xj7-2jxx Drupal access control bypass vulnerability

HIGH Published 2022-05-13 Modified 2024-04-23 Official page ↗
Aliases
CVE-2017-6919
Ecosystem
Packagist
Packages
drupal/core, drupal/drupal
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-284
Reviewed
2024-04-23

Affected packages

• Packagist drupal/core: >= 8.0, < 8.2.8 → fixed in 8.2.8 • Packagist drupal/core: >= 8.3.0, < 8.3.1 → fixed in 8.3.1 • Packagist drupal/drupal: >= 8.0, < 8.2.8 → fixed in 8.2.8 • Packagist drupal/drupal: >= 8.3.0, < 8.3.1 → fixed in 8.3.1

Description

Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.

Related

Alias · CVE (1)

  • CVE-2017-6919 Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References