CVE-2017-6931
Medium
Description
In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update certain data that they do not have the permissions for. If you have implemented a Settings Tray form in contrib or a custom module, the correct access checks should be added. This release fixes the only two implementations in core, but does not harden against other such bypasses. This vulnerability can be mitigated by disabling the Settings Tray module.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Drupal
PublishedMar 1, 2018
First seenMar 1, 2018
How to fix
Update
- drupal drupal8.4.5 or later
- drupal/core8.4.5 or later
- drupal/drupal8.4.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal drupal | 8.4.0 ≤ v < 8.4.5 | 8.4.5 |
| drupal/corePackagist | 8.4.0 ≤ v < 8.4.5 | 8.4.5 |
| drupal/drupalPackagist | 8.4.0 ≤ v < 8.4.5 | 8.4.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.