CVE-2017-6377

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Drupal	Drupal Core	8.2.x versions before 8.2.7

References

http://www.securityfocus.com/bid/96919Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038058
https://www.drupal.org/SA-2017-001Vendor Advisory
http://www.securityfocus.com/bid/96919Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038058
https://www.drupal.org/SA-2017-001Vendor Advisory

Timeline

Published: Mar 16, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-63797.5Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blo CVE-2017-63818.1A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated b CVE-2017-63847.5Memory leak in the login_user function in saslserv/main.c in saslserv/main.so in Atheme 7.2.7 allows a remote unauthenticated attacker to co CVE-2017-63866.5Memory leak in the vrend_create_vertex_elements_state function in vrend_renderer.c in virglrenderer allows local guest OS users to cause a d CVE-2017-63875.5The dex_loadcode function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (out-of-bounds read CVE-2017-63906.1An issue was discovered in whatanime.ga before c334dd8499a681587dd4199e90b0aa0eba814c1d. The vulnerability exists due to insufficient filtra CVE-2017-63916.1An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed CVE-2017-63926.1An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed CVE-2017-63936.1An issue was discovered in NagVis 1.9b12. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "nagvi CVE-2017-63946.1Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient fil CVE-2017-63956.1An issue was discovered in HashOver 2.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the 'hashov CVE-2017-63966.1An issue was discovered in WPO-Foundation WebPageTest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data pas