Vulnerability Details : CVE-2017-6377
When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.
Products affected by CVE-2017-6377
- cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:8.2.6:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-6377
0.25%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 62 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-6377
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST | |
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2017-6377
-
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-6377
-
https://www.drupal.org/SA-2017-001
Drupal Core - Multiple Vulnerabilities - SA-CORE-2017-001 | Drupal.orgVendor Advisory
-
http://www.securitytracker.com/id/1038058
Drupal Multiple Flaws Let Remote Users Conduct Cross-Site Request Forgery Attacks and Execute Arbitrary Code and Let Remote Authenticated Users Access Files on the Target System - SecurityTracker
-
http://www.securityfocus.com/bid/96919
Drupal Core DRUPAL-SA-CORE-2017-001 Multiple Security VulnerabilitiesThird Party Advisory;VDB Entry
Jump to