Improper input validation in Drupal
CVE-2017-6921
In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.018 (78.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 78th percentile — 78.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.018 · change: 0.000
Affected products
- Drupal
- Drupal Core — versions Drupal 8
Weakness classification (CWE)
References
- www.securityfocus.com/bid/99222 (VDB Entry, Third Party Advisory, vdb-entry)
- www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21… (Mitigation, Vendor Advisory)
- www.securitytracker.com/id/1038781 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2017-6921?
- CVE-2017-6921 is a medium-severity vulnerability in Drupal, classified under Improper Input Validation. CVSS score: 5.9/10. Published 2019-01-15.
- How severe is CVE-2017-6921?
- Medium severity. CVSS v3 base score is 5.9 out of 10.