Fluid Attacks Database

Description

Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
packagist	drupal/drupal	>=8.0 <8.3.7	8.3.7
packagist	drupal/core	>=8.0 <8.3.7	8.3.7

Aliases

1. CVE-2017-69252. NVD-2017-69253. OSV-2017-69254. GCVE-2017-6925

References

1. https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6925.yaml2. https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6925.yaml3. https://www.drupal.org/SA-CORE-2017-0044. https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple5. http://www.securityfocus.com/bid/1003686. http://www.securitytracker.com/id/1039200

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.