PT-2017-17416

CVE-2017-6919

Publicado

2017-04-20

Atualizado

2022-05-13

Descrição por

CVSS 3.1

7.5

Alta

MétricasAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal 8 versions prior to 8.2.8 Drupal 8.3 versions prior to 8.3.1

Description The issue allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.

Recommendations For Drupal 8 versions prior to 8.2.8, update to version 8.2.8 or later. For Drupal 8.3 versions prior to 8.3.1, update to version 8.3.1 or later.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Samuel Mortenson

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-284: Improper Access Control

Identificadores relacionados

CVE-2017-6919