[SECURITY] Fedora 26 Update: drupal8-8.3.1-1.fc26

Drupal is an open source content management platform powering millions of websites and applications. Its built, used, and supported by an active and diverse community of people around the world...

Drupal 8.x < 8.2.8 / 8.3.x < 8.3.1 Access Bypass Vulnerability (SA-CORE-2017-002)

According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.2.8 or 8.3.x prior to 8.3.1. It is, therefore, affected by an access bypass vulnerability due to an unspecified flaw when the RESTful Web Services rest module is enabled and the site...

Drupal Core Privilege Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A privilege bypass vulnerability exists in Drupal Core version 8 before 8.2.8 and version 8.3 before 8.3.1. If the RESTful Web Services rest module is enabled, the site...

Drupal Core - Access Bypass vulnerability (CVE-2017-6919)

This is a critical access bypass vulnerability. A site is only affected by this if all of the following conditions are met: The site has the RESTful Web Services rest module enabled. The site allows PATCH requests. An attacker can get or register a user account on the site. While we don't normall...

Drupal Closes Access Bypass Vulnerability in Core Engine

A critical vulnerability in the Drupal Core engine was addressed in an update released Wednesday. Drupal engineers are calling it an access bypass vulnerability and said a Drupal-based website is vulnerable only under certain conditions, including whether a site has the RESTful Web Services modul...

CVE-2017-6919

Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services rest module is enabled and the site allows PATCH requests...

CVE-2017-6919

Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services rest module is enabled and the site allows PATCH requests...

CVE-2017-6919

Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services rest module is enabled and the site allows PATCH requests...

Design/Logic Flaw

Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services rest module is enabled and the site allows PATCH requests...

CVE-2017-6919

CVE-2017-6919 affects Drupal 8 where, if RESTful Web Services (rest) is enabled and PATCH requests are allowed, an authenticated user can bypass access controls. Affected versions are Drupal 8 up to 8.2.8 and 8.3 up to 8.3.1. The underlying issue is a critical access bypass in the REST module, en...

CVE-2017-6919

Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services rest module is enabled and the site allows PATCH requests...

Drupal Core Access Bypass Vulnerability (SA-CORE-2017-002)

Drupal is prone to an access bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

Access bypass

More info at https://www.drupal.org/SA-2017-002...

Drupal Releases Security Updates

Drupal has released an advisory to address a vulnerability in Drupal core 8.x versions prior to 8.2.8 and 8.3.1. A remote attacker could exploit this vulnerability to obtain sensitive information. US-CERT encourages users and administrators to review Drupal's Security Advisory and upgrade to...

drupal8 -- Drupal Core - Critical - Access Bypass

Drupal Security Team Reports: CVE-2017-6919: Access bypass...

Unspecified vulnerability in Drupal Legal module

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An unspecified vulnerability exists in the Drupal Legal module. A detailed vulnerability description is not currently available...

Unspecified Vulnerability in Drupal Filemaker Form Module

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An unspecified vulnerability exists in the Drupal Filemaker Form module, for which a detailed vulnerability description is not currently available...

Scheduler Workbench Integration - Critical - Unsupported - SA-CONTRIB-2017-39

Updates 20170414 - A new module maintainer has been found and a new release for this module has been published. Provides integration between the Scheduler module and the Workbench Moderation module. The security team is marking this module unsupported. There is a known security issue with the...

@Base - Critical - Unsupported - SA-CONTRIB-2017-040

Provide some more API for developer to work with Drupal 7. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466...

Filemaker Form - Critical - Unsupported - SA-CONTRIB-2017-37

Easily create forms in Drupal that submit data to Filemaker databases which are hosted on Filemaker Server. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module,...