{"id":"CVE-2017-6919","published":"2017-04-20T02:43:00Z","modified":"2024-08-05T15:49:02Z","title":"Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web…","vendor":null,"product":null,"tier":"tail","description":{"text":"Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01606,"percentile":0.7578,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/97941","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://www.drupal.org/SA-CORE-2017-002","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1038371","tags":["vdb-entry","x_refsource_SECTRACK"]}],"priority":{"score":15.2,"factors":[{"name":"EPSS percentile","points":15.16}]},"affectedVersions":[{"vendor":"n/a","product":"Drupal","versions":["Drupal"]}],"affected":[{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.0, <8.2.8",">=8.3.0, <8.3.1"],"patched":["8.2.8","8.3.1"],"from":["GHSA-6hpj-9xj7-2jxx"],"provenance":"source"},{"ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=8.0, <8.2.8",">=8.3.0, <8.3.1"],"patched":["8.2.8","8.3.1"],"from":["GHSA-6hpj-9xj7-2jxx"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2803","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-6377","published":"2017-03-16","fixed":"8.2.7","kev":false},{"cve":"CVE-2017-6379","published":"2017-03-16","fixed":"8.2.7","kev":false},{"cve":"CVE-2017-6381","published":"2017-03-16","fixed":"8.2.7","kev":false,"link":{"from":"CVE-2017-6381","to":"CVE-2017-6919","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/drupal","fromFixed":"8.2.7","toFixed":"8.2.8","daysApart":35},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"8.2.7","toFixed":"8.2.8","daysApart":35}]}},{"cve":"CVE-2017-6919","published":"2017-04-20","fixed":"8.3.1","kev":false},{"cve":"CVE-2017-6920","published":"2018-08-06","fixed":"8.3.4","kev":false,"link":{"from":"CVE-2017-6919","to":"CVE-2017-6920","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/drupal","fromFixed":"8.3.1","toFixed":"8.3.4","daysApart":473},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"8.3.1","toFixed":"8.3.4","daysApart":473}]}},{"cve":"CVE-2017-6921","published":"2019-01-15","fixed":"8.3.4","kev":false,"link":{"from":"CVE-2017-6919","to":"CVE-2017-6921","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/drupal","fromFixed":"8.3.1","toFixed":"8.3.4","daysApart":635},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"8.3.1","toFixed":"8.3.4","daysApart":635},{"kind":"similar","provenance":"machine","score":0.61,"basis":"same package + description similarity"}]}},{"cve":"CVE-2017-6922","published":"2019-01-22","fixed":"8.3.4","kev":false,"link":{"from":"CVE-2017-6919","to":"CVE-2017-6922","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/drupal","fromFixed":"8.3.1","toFixed":"8.3.4","daysApart":642},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"8.3.1","toFixed":"8.3.4","daysApart":642}]}}],"package":"Packagist:drupal/drupal"}}