CVE-2017-6924
REST API can bypass comment approval - Access Bypass - Moderately Critical
Also known as GHSA-p8g6-5mg7-9r5q
Published 7 y ago · modified 4 mo ago · JSON
Summary
In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to post comments, or where anonymous users can post comments.
Exploit prediction (EPSS)
2.10% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.4 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| GitHub | 3.0 | 7.4 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | drupal/core | >=8.0, <8.3.7 | 8.3.7 |
| packagist | drupal/drupal | >=8.0, <8.3.7 | 8.3.7 |
Affected products
- Drupal Drupal Core
Classification
- Weakness
- CWE-269 Improper Privilege Management
References
- securityfocus.com /bid/100368 · vdb-entry, x_refsource_BID, x_transferred
- drupal.org /forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1039200 · vdb-entry, x_refsource_SECTRACK, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-6924 · advisory
- github.com /FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6924.yaml · web
- github.com /FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6924.yaml · web
- github.com /drupal/core · package
- drupal.org /SA-CORE-2017-004 · web
Sources
- CVE List: CVE-2017-6924
- GitHub Advisory: GHSA-p8g6-5mg7-9r5q
- NVD: CVE-2017-6924
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.