CVE-2017-6924: fallo en Drupal Core
REST API can bypass comment approval - Access Bypass - Moderately Critical
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 2.1%
In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to post comments, or where anonymous users can post comments.
Productos afectados
Drupal · Drupal CoreCVEs relacionadas — Drupal Core
En el mismo producto, de las más peligrosas a las menos.
CVE-2019-6340HIGHDrupal core - Highly critical - Remote Code ExecutionEPSS 92.0%KEVCVE-2020-13671HIGHCVE-2020-13671EPSS 36.2%KEVCVE-2017-6381—CVE-2017-6381EPSS 3.9%CVE-2020-13664—CVE-2020-13664EPSS 3.0%CVE-2020-13666—CVE-2020-13666EPSS 2.9%CVE-2019-6342—Drupal core - Critical - Access bypass - SA-CORE-2019-008EPSS 2.2%