CVE-2017-6930
Drupal access bypass vulnerability
Also known as GHSA-3327-jr93-7hq3
Published 8 y ago · modified 4 mo ago · JSON
Summary
In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_access_records().
Exploit prediction (EPSS)
1.29% probability of exploitation in the next 30 days, higher than 70% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | drupal/core | >=8.4.0, <8.4.5 | 8.4.5 |
| packagist | drupal/drupal | >=8.4.0, <8.4.5 | 8.4.5 |
Affected products
- Drupal.org Drupal Core
Classification
- Weakness
- CWE-284 Improper Access Control
References
- drupal.org /sa-core-2018-001 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-6930 · advisory
- github.com /FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6930.yaml · web
- github.com /FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6930.yaml · web
- github.com /drupal/core · package
Sources
- CVE List: CVE-2017-6930
- GitHub Advisory: GHSA-3327-jr93-7hq3
- NVD: CVE-2017-6930
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.