Drupal editor module incorrectly checks access to inline private files
When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-6377US | high7.5OT elevated | — | ||
When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass. | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.securityfocus.com/bid/96919WEB
- http://www.securitytracker.com/id/1038058WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6377.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6377.yamlWEB
- https://github.com/drupal/drupalPACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2017-6377ADVISORY
- https://www.drupal.org/SA-2017-001WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan