GitHub Advisoryadvisory · Packagist

GHSA-w7qx-vwr9-2j3r Drupal editor module incorrectly checks access to inline private files

HIGH Published 2022-05-13 Modified 2024-04-23 Official page ↗
Aliases
CVE-2017-6377
Ecosystem
Packagist
Packages
drupal/core, drupal/drupal
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-863
Reviewed
2024-04-23

Affected packages

• Packagist drupal/core: >= 8.2.0, < 8.2.7 → fixed in 8.2.7 • Packagist drupal/drupal: >= 8.2.0, < 8.2.7 → fixed in 8.2.7

Description

When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.

Related

Alias · CVE (1)

  • CVE-2017-6377 When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References