Drupal editor module incorrectly checks access to inline private files
When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-6377US | high7.5OT erhöht | — | ||
When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.securityfocus.com/bid/96919WEB
- http://www.securitytracker.com/id/1038058WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6377.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6377.yamlWEB
- https://github.com/drupal/drupalPACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2017-6377ADVISORY
- https://www.drupal.org/SA-2017-001WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan