GitHub Advisoryadvisory · Packagist

GHSA-f4qx-jqfq-7785 Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions

CRITICAL Published 2022-05-13 Modified 2024-04-23 Official page ↗
Aliases
CVE-2017-6925
Ecosystem
Packagist
Packages
drupal/core, drupal/drupal
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269
Reviewed
2024-04-23

Affected packages

• Packagist drupal/core: >= 8.0, < 8.3.7 → fixed in 8.3.7 • Packagist drupal/drupal: >= 8.0, < 8.3.7 → fixed in 8.3.7

Description

In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity.

Related

Alias · CVE (1)

  • CVE-2017-6925 In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view,… vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References