CVE-2017-6919

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	Drupal	Drupal

References

http://www.securityfocus.com/bid/97941Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038371
https://www.drupal.org/SA-CORE-2017-002Patch, Vendor Advisory
http://www.securityfocus.com/bid/97941Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038371
https://www.drupal.org/SA-CORE-2017-002Patch, Vendor Advisory

Timeline

Published: Apr 20, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-69209.8Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects s CVE-2017-69215.9In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected b CVE-2017-69226.5In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not perm CVE-2017-69236.5In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views CVE-2017-69247.4In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even CVE-2017-69259.8In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, CVE-2017-69268.1In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have CVE-2017-69276.1Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape CVE-2017-69285.3Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has access to a file bef CVE-2017-69296.1A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by th CVE-2017-69308.1In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated versi CVE-2017-69316.5In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that th