Design/Logic Flaw

When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass...

CVE-2017-6377

When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass...

CVE-2017-6381

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerabl...

UBUNTU-CVE-2017-6381

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerabl...

CVE-2017-6379

Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID...

CVE-2017-6381

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerabl...

CVE-2017-6377

CVE-2017-6377 affects Drupal 8.2.x prior to 8.2.7. The editor module fails to properly check access when attaching private files, causing an access bypass. Documents reference the Drupal editor access issue (SA-2017-001) and multiple advisories; affected versions are Drupal 8.x before 8.2.7. Reme...

CVE-2017-6379

CVE-2017-6379 concerns Drupal 8.x: admin paths in 8.2.x prior to 8.2.7 lacked CSRF protection, allowing an attacker to disable some blocks on a site. The issue is mitigated by the requirement that an attacker know the block ID. Connected sources (DRUPAL GHSA/NVD records) corroborate that this is ...

CVE-2017-6377

When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass...

CVE-2017-6381

CVE-2017-6381 corresponds to a Drupal RCE via the PHPUnit component bundled with Drupal 8 development dependencies. Affected if running Drupal versions before 8.2.2; mitigation in the public description notes that .htaccess generally blocks PHP execution and that Composer development dependencies...

Drupal Services module remote code execution vulnerability (CNVD-2017-03557)

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Services is one of the modules that allows users to programmatically create customized Web service items. A remote code execution vulnerability exists in the Services module of Drupal. ...

Drupal Password Reset Landing Page Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Password Reset Landing Page Module is a password reset page module. An access bypass vulnerability exists in the Drupal Password Reset Landing Page Module. This vulnerability can be...

Editor module incorrectly checks access to inline private files

More info at https://www.drupal.org/SA-2017-001...

Some admin paths were not protected with a CSRF token

More info at https://www.drupal.org/SA-2017-001...

Remote code execution

More info at https://www.drupal.org/SA-2017-001...

Editor module incorrectly checks access to inline private files

More info at https://www.drupal.org/SA-2017-001...

Some admin paths were not protected with a CSRF token

More info at https://www.drupal.org/SA-2017-001...

Remote code execution

More info at https://www.drupal.org/SA-2017-001...

Private - Critical - Access bypass - DRUPAL-SA-CONTRIB-2017-031

This module enables you to mark nodes as private so that they are only accessible to users that have been granted an extra permissions. The module doesn't always enforce the access restrictions. In some cases a node that a site admin expects to be private is actually accessible as normal or nodes...

Drupal Releases Security Update

Drupal has released an advisory to address vulnerabilities in Drupal core 8.x versions prior to 8.2.7. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review Drupal's Security Advisory and apply th...