CVE-2017-6925
published 2019-01-15CVE-2017-6925: In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or…
PriorityP354critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
3.02%
85.8th percentile
In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| drupal | core | >= 8.0 < 8.3.7 | 8.3.7 |
| drupal | drupal | >= 8.0 < 8.3.7 | 8.3.7 |
| drupal | drupal | >= 8.0.0 < 8.3.7 | 8.3.7 |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
ghsa·2022-05-13
CVE-2017-6925 [CRITICAL] CWE-269 Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity.
OSV
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
osv·2022-05-13
CVE-2017-6925 [CRITICAL] Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-6923 CVE-2017-6924 CVE-2017-6925 drupal8: Multiple Vulnerabilities - SA-CORE-2017-004 [fedora-all]
bugzilla·2017-08-22·CVSS 6.5
CVE-2017-6923 [MEDIUM] CVE-2017-6923 CVE-2017-6924 CVE-2017-6925 drupal8: Multiple Vulnerabilities - SA-CORE-2017-004 [fedora-all]
CVE-2017-6923 CVE-2017-6924 CVE-2017-6925 drupal8: Multiple Vulnerabilities - SA-CORE-2017-004 [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affec
Bugzilla
CVE-2017-6923 CVE-2017-6924 CVE-2017-6925 drupal8: Multiple Vulnerabilities - SA-CORE-2017-004
bugzilla·2017-08-22·CVSS 6.5
CVE-2017-6923 [MEDIUM] CVE-2017-6923 CVE-2017-6924 CVE-2017-6925 drupal8: Multiple Vulnerabilities - SA-CORE-2017-004
CVE-2017-6923 CVE-2017-6924 CVE-2017-6925 drupal8: Multiple Vulnerabilities - SA-CORE-2017-004
Follwowing vulnerabilities have been addressed in Drupal 8.3.7:
* Views - Access Bypass - Moderately Critical - Drupal 8 - CVE-2017-6923:
When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view.
It is best practice to always include some form of access restrictions on all views, even if you are using another module to display them.
* REST API can bypass comment approval - Access Bypass - Moderately Critical - Drupal 8 - CVE-2017-6924:
When using the REST API, users without the
http://www.securityfocus.com/bid/100368http://www.securitytracker.com/id/1039200https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiplehttp://www.securityfocus.com/bid/100368http://www.securitytracker.com/id/1039200https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple
2019-01-15
Published