Fluid Attacks Database

Description

Drupal access control bypass vulnerability Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	drupal/drupal	>=8.0 <8.2.8 \|\| >=8.3.0 <8.3.1	8.2.8, 8.3.1
packagist	drupal/core	>=8.0 <8.2.8 \|\| >=8.3.0 <8.3.1	8.2.8, 8.3.1

Aliases

1. CVE-2017-69192. NVD-2017-69193. OSV-2017-69194. GCVE-2017-6919

References

1. https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6919.yaml2. https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6919.yaml3. https://www.drupal.org/SA-2017-0024. https://www.drupal.org/SA-CORE-2017-0025. http://www.securityfocus.com/bid/979416. http://www.securitytracker.com/id/1038371