vulnwire
6.5med

CVE-2017-6923

Access bypass in Drupal 8 views

Also known as GHSA-v3f6-f29f-rgvp

Published 7 y ago · modified 4 mo ago · JSON

CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.0%
percentile 81%
Public exploits
0
none known

In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view. It is best practice to always include some form of access restrictions on all views, even if you are using another module to display them.

Exploit prediction (EPSS)

2.02% probability of exploitation in the next 30 days, higher than 81% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD2.04.0AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub3.06.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
packagistdrupal/core
>=8.0, <8.3.7
8.3.7
packagistdrupal/drupal
>=8.0, <8.3.7
8.3.7

Affected products

  • Drupal Drupal core

Classification

Weakness

References

  • securityfocus.com /bid/100368 · vdb-entry, x_refsource_BID, x_transferred
  • drupal.org /forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1039200 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-6923 · advisory
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6923.yaml · web
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6923.yaml · web
  • drupal.org /SA-CORE-2017-004 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.