Vulnerability Details : CVE-2017-6923
In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view. It is best practice to always include some form of access restrictions on all views, even if you are using another module to display them.
Exploit prediction scoring system (EPSS) score for CVE-2017-6923
Probability of exploitation activity in the next 30 days: 0.16%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 52 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-6923
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST |
|
N/A
|
NONE | CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N |
0.1
|
N/A
|
Drupal.org |
|
6.5
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2017-6923
-
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-6923
-
https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple
Drupal Core - Multiple Vulnerabilities - SA-CORE-2017-004 | Drupal.orgRelease Notes;Vendor Advisory;Patch
-
http://www.securityfocus.com/bid/100368
Drupal Core DRUPAL-SA-CORE-2017-004 Multiple Access Bypass VulnerabilitiesThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1039200
Drupal Access Control Flaws Let Remote Authenticated Users Bypass Security Restrictions on the Target System - SecurityTrackerThird Party Advisory;VDB Entry
Products affected by CVE-2017-6923
- cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*