Vulnerability Details : CVE-2017-6924
In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to post comments, or where anonymous users can post comments.
Products affected by CVE-2017-6924
- cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-6924
0.34%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 72 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-6924
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:N |
8.6
|
4.9
|
NIST | |
|
N/A
|
NONE | CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N |
0.1
|
N/A
|
Drupal.org | |
|
7.4
|
HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
2.2
|
5.2
|
NIST |
CWE ids for CVE-2017-6924
-
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-6924
-
https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple
Drupal Core - Multiple Vulnerabilities - SA-CORE-2017-004 | Drupal.orgMitigation;Vendor Advisory
-
http://www.securityfocus.com/bid/100368
Drupal Core DRUPAL-SA-CORE-2017-004 Multiple Access Bypass VulnerabilitiesThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1039200
Drupal Access Control Flaws Let Remote Authenticated Users Bypass Security Restrictions on the Target System - SecurityTrackerThird Party Advisory;VDB Entry
Jump to