7.5

CVE-2017-6919

Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Drupal ≫ Drupal Version 8.0.0
Drupal ≫ Drupal Version 8.0.0 Update alpha10
Drupal ≫ Drupal Version 8.0.0 Update alpha11
Drupal ≫ Drupal Version 8.0.0 Update alpha12
Drupal ≫ Drupal Version 8.0.0 Update alpha13
Drupal ≫ Drupal Version 8.0.0 Update alpha14
Drupal ≫ Drupal Version 8.0.0 Update alpha15
Drupal ≫ Drupal Version 8.0.0 Update alpha2
Drupal ≫ Drupal Version 8.0.0 Update alpha3
Drupal ≫ Drupal Version 8.0.0 Update alpha4
Drupal ≫ Drupal Version 8.0.0 Update alpha5
Drupal ≫ Drupal Version 8.0.0 Update alpha6
Drupal ≫ Drupal Version 8.0.0 Update alpha7
Drupal ≫ Drupal Version 8.0.0 Update alpha8
Drupal ≫ Drupal Version 8.0.0 Update alpha9
Drupal ≫ Drupal Version 8.0.0 Update beta1
Drupal ≫ Drupal Version 8.0.0 Update beta10
Drupal ≫ Drupal Version 8.0.0 Update beta11
Drupal ≫ Drupal Version 8.0.0 Update beta12
Drupal ≫ Drupal Version 8.0.0 Update beta13
Drupal ≫ Drupal Version 8.0.0 Update beta14
Drupal ≫ Drupal Version 8.0.0 Update beta15
Drupal ≫ Drupal Version 8.0.0 Update beta16
Drupal ≫ Drupal Version 8.0.0 Update beta2
Drupal ≫ Drupal Version 8.0.0 Update beta3
Drupal ≫ Drupal Version 8.0.0 Update beta4
Drupal ≫ Drupal Version 8.0.0 Update beta6
Drupal ≫ Drupal Version 8.0.0 Update beta7
Drupal ≫ Drupal Version 8.0.0 Update beta9
Drupal ≫ Drupal Version 8.0.0 Update rc1
Drupal ≫ Drupal Version 8.0.0 Update rc2
Drupal ≫ Drupal Version 8.0.0 Update rc3
Drupal ≫ Drupal Version 8.0.0 Update rc4
Drupal ≫ Drupal Version 8.0.1
Drupal ≫ Drupal Version 8.0.2
Drupal ≫ Drupal Version 8.0.3
Drupal ≫ Drupal Version 8.0.4
Drupal ≫ Drupal Version 8.0.5
Drupal ≫ Drupal Version 8.0.6
Drupal ≫ Drupal Version 8.1.0
Drupal ≫ Drupal Version 8.1.0 Update beta1
Drupal ≫ Drupal Version 8.1.0 Update beta2
Drupal ≫ Drupal Version 8.1.0 Update rc1
Drupal ≫ Drupal Version 8.1.1
Drupal ≫ Drupal Version 8.1.2
Drupal ≫ Drupal Version 8.1.3
Drupal ≫ Drupal Version 8.1.4
Drupal ≫ Drupal Version 8.1.5
Drupal ≫ Drupal Version 8.1.6
Drupal ≫ Drupal Version 8.1.7
Drupal ≫ Drupal Version 8.1.8
Drupal ≫ Drupal Version 8.1.9
Drupal ≫ Drupal Version 8.1.10
Drupal ≫ Drupal Version 8.2.0
Drupal ≫ Drupal Version 8.2.0 Update beta1
Drupal ≫ Drupal Version 8.2.0 Update beta2
Drupal ≫ Drupal Version 8.2.0 Update beta3
Drupal ≫ Drupal Version 8.2.0 Update rc1
Drupal ≫ Drupal Version 8.2.0 Update rc2
Drupal ≫ Drupal Version 8.2.1
Drupal ≫ Drupal Version 8.2.2
Drupal ≫ Drupal Version 8.2.3
Drupal ≫ Drupal Version 8.2.4
Drupal ≫ Drupal Version 8.2.5
Drupal ≫ Drupal Version 8.2.6
Drupal ≫ Drupal Version 8.2.7
Drupal ≫ Drupal Version 8.3.0
Drupal ≫ Drupal Version 8.3.0 Update alpha1
Drupal ≫ Drupal Version 8.3.0 Update beta1
Drupal ≫ Drupal Version 8.3.0 Update rc1
Drupal ≫ Drupal Version 8.3.0 Update rc2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.61% 0.727
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 1.6 5.9
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 6 6.8 6.4
AV:N/AC:M/Au:S/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.securityfocus.com/bid/97941
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038371
https://www.drupal.org/SA-CORE-2017-002
Patch
Vendor Advisory