Lucene search

DrupalCVE-2017-6926

HistoryMar 01, 2018 - 11:29 p.m.

CVE-2017-6926

2018-03-0123:29:00

CWE-200

drupal

web.nvd.nist.gov

cve-2017-6926

drupal

vulnerability

unauthorized access

comments

nvd

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the attacker must have permission to post comments.

Affected configurations

Nvd

Node

drupaldrupalRange8.4.0–8.4.5

VendorProductVersionCPE
drupaldrupal*cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
drupal	drupal	*	cpe:2.3:a:drupal:drupal::::::::

CNA Affected

[
  {
    "product": "Drupal Core",
    "vendor": "Drupal.org",
    "versions": [
      {
        "status": "affected",
        "version": "8.4.x versions before 8.4.5"
      }
    ]
  }
]