CVE-2017-6921

published 2019-01-15

CVE-2017-6921: In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site…

Priority P4 34 medium 5.9 CVSS 3.0

AV N AC H PR N UI N S U C N I H A N

In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
drupal	core	>= 8.0 < 8.3.4	8.3.4
drupal	drupal	>= 8.0 < 8.3.4	8.3.4
drupal	drupal	>= 8.0.0 < 8.3.4	8.3.4
drupal	drupal_core	>= Drupal 8 < 8.3.4	8.3.4

CVSS provenance

nvd v3.0 5.9 MEDIUM CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20