vulnwire
9.8crit

CVE-2017-6925

Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions

Also known as GHSA-f4qx-jqfq-7785

Published 7 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.0%
percentile 87%
Public exploits
0
none known

In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity.

Exploit prediction (EPSS)

3.02% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
packagistdrupal/core
>=8.0, <8.3.7
8.3.7
packagistdrupal/drupal
>=8.0, <8.3.7
8.3.7

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

  • securityfocus.com /bid/100368 · vdb-entry, x_refsource_BID, x_transferred
  • drupal.org /forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1039200 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-6925 · advisory
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6925.yaml · web
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6925.yaml · web
  • github.com /drupal/core · package
  • drupal.org /SA-CORE-2017-004 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.