Improper input validation in Drupal
CVE-2017-6921
In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.018 (76.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Drupal
- Drupal Core — versions Drupal 8
Weakness classification (CWE)
References
- mlhess@drupal.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- mlhess@drupal.org (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
- mlhess@drupal.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2017-6921?
- CVE-2017-6921 is a medium-severity vulnerability in Drupal, classified under Improper Input Validation. CVSS score: 5.9/10. Published 2019-01-15.
- How severe is CVE-2017-6921?
- Medium severity. CVSS v3 base score is 5.9 out of 10.