CVE-2017-6924

Low

Low Medium High Critical

CVSS Score

Published: Jan 15, 2019

Last Modified: Nov 21, 2024

Vulnerability Description

In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to post comments, or where anonymous users can post comments.

Known Affected Software

35 configuration(s) from 1 vendor(s)

drupal

Version:

8.0

CPE:

cpe:2.3:a:drupal:drupal:8.0:alpha10:*:*:*:*:*:*

drupal

Version:

8.2.2

CPE:

cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*

drupal

Version:

8.1.10

CPE:

cpe:2.3:a:drupal:drupal:8.1.10:*:*:*:*:*:*:*

drupal

Version:

8.0.0

CPE:

cpe:2.3:a:drupal:drupal:8.0.0:beta10:*:*:*:*:*:*

drupal

Version:

8.1.4

CPE:

cpe:2.3:a:drupal:drupal:8.1.4:*:*:*:*:*:*:*

drupal

Version:

8.1.2

CPE:

cpe:2.3:a:drupal:drupal:8.1.2:*:*:*:*:*:*:*

drupal

Version:

8.0.3

CPE:

cpe:2.3:a:drupal:drupal:8.0.3:*:*:*:*:*:*:*

drupal

Version:

8.0.2

CPE:

cpe:2.3:a:drupal:drupal:8.0.2:*:*:*:*:*:*:*

drupal

Version:

8.0.1

CPE:

cpe:2.3:a:drupal:drupal:8.0.1:*:*:*:*:*:*:*

drupal

Version:

8.2.5

CPE:

cpe:2.3:a:drupal:drupal:8.2.5:*:*:*:*:*:*:*

drupal

Version:

8.1.3

CPE:

cpe:2.3:a:drupal:drupal:8.1.3:*:*:*:*:*:*:*

drupal

Version:

8.2.0

CPE:

cpe:2.3:a:drupal:drupal:8.2.0:-:*:*:*:*:*:*

drupal

Version:

8.1.7

CPE:

cpe:2.3:a:drupal:drupal:8.1.7:*:*:*:*:*:*:*

drupal

Version:

8.2.1

CPE:

cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*

drupal

Version:

8.3.6

CPE:

cpe:2.3:a:drupal:drupal:8.3.6:*:*:*:*:*:*:*

drupal

Version:

8.1.5

CPE:

cpe:2.3:a:drupal:drupal:8.1.5:*:*:*:*:*:*:*

drupal

Version:

8.0.4

CPE:

cpe:2.3:a:drupal:drupal:8.0.4:*:*:*:*:*:*:*

drupal

Version:

8.1.0

CPE:

cpe:2.3:a:drupal:drupal:8.1.0:-:*:*:*:*:*:*

drupal

Version:

8.1.8

CPE:

cpe:2.3:a:drupal:drupal:8.1.8:*:*:*:*:*:*:*

drupal

Version:

8.0.5

CPE:

cpe:2.3:a:drupal:drupal:8.0.5:*:*:*:*:*:*:*

drupal

Version:

8.0.6

CPE:

cpe:2.3:a:drupal:drupal:8.0.6:*:*:*:*:*:*:*

drupal

Version:

8.3.5

CPE:

cpe:2.3:a:drupal:drupal:8.3.5:*:*:*:*:*:*:*

drupal

Version:

8.2.7

CPE:

cpe:2.3:a:drupal:drupal:8.2.7:*:*:*:*:*:*:*

drupal

Version:

8.1.9

CPE:

cpe:2.3:a:drupal:drupal:8.1.9:*:*:*:*:*:*:*

drupal

Version:

8.2.3

CPE:

cpe:2.3:a:drupal:drupal:8.2.3:*:*:*:*:*:*:*

drupal

Version:

8.2.4

CPE:

cpe:2.3:a:drupal:drupal:8.2.4:*:*:*:*:*:*:*

drupal

Version:

8.3.3

CPE:

cpe:2.3:a:drupal:drupal:8.3.3:*:*:*:*:*:*:*

drupal

Version:

8.2.6

CPE:

cpe:2.3:a:drupal:drupal:8.2.6:*:*:*:*:*:*:*

drupal

Version:

8.3.2

CPE:

cpe:2.3:a:drupal:drupal:8.3.2:*:*:*:*:*:*:*

drupal

Version:

8.2.8

CPE:

cpe:2.3:a:drupal:drupal:8.2.8:*:*:*:*:*:*:*

drupal

Version:

8.3.0

CPE:

cpe:2.3:a:drupal:drupal:8.3.0:-:*:*:*:*:*:*

drupal

Version:

8.3.1

CPE:

cpe:2.3:a:drupal:drupal:8.3.1:*:*:*:*:*:*:*

drupal

Version:

8.3.4

CPE:

cpe:2.3:a:drupal:drupal:8.3.4:*:*:*:*:*:*:*

drupal

Version:

8.1.1

CPE:

cpe:2.3:a:drupal:drupal:8.1.1:*:*:*:*:*:*:*

drupal

Version:

8.1.6

CPE:

cpe:2.3:a:drupal:drupal:8.1.6:*:*:*:*:*:*:*

This vulnerability affects 35 software configuration(s). Ensure you patch all affected systems.

References & Resources

Severity Details

out of 10.0

Low

Weakness Type (CWE)

CWE-269 Top 25 #25

Improper Privilege Management

Description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Exploit Likelihood: Medium
Typical Severity: High
OWASP Top 10: A01:2021-Broken Access Control
Abstraction Level: Class