CVE-2017-6923: fallo en Drupal core
Access bypass in Drupal 8 views
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 2.0%
In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view. It is best practice to always include some form of access restrictions on all views, even if you are using another module to display them.
Productos afectados
Drupal · Drupal coreCVEs relacionadas — Drupal core
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-9082CRITICALDrupal core - Highly critical - SQL injection - SA-CORE-2026-004EPSS 89.4%KEVCVE-2019-6339—PHAR stream wrapper Arbitrary PHP code executionEPSS 35.9%CVE-2019-6341—Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004EPSS 12.2%CVE-2024-45440MEDIUMCVE-2024-45440EPSS 9.3%CVE-2019-6338—third-party PEAR Archive_Tar library updatesEPSS 2.1%CVE-2025-31674HIGHDrupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003EPSS 0.6%