CVE-2017-6924
High
Description
In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to post comments, or where anonymous users can post comments.
SeverityHigh
CVSS7.4
Exploit probability—
Product
Drupal
PublishedJan 15, 2019
First seenJan 15, 2019
How to fix
Update
- drupal drupal8.3.7 or later
- drupal/core8.3.7 or later
- drupal/drupal8.3.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal drupal | 8.0.0 ≤ v < 8.3.7 | 8.3.7 |
| drupal/corePackagist | 8.0 ≤ v < 8.3.7 | 8.3.7 |
| drupal/drupalPackagist | 8.0 ≤ v < 8.3.7 | 8.3.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.