What is CVE-2017-6924?

CVE-2017-6924 is a high-severity vulnerability in Drupal, classified under Improper Privilege Management. CVSS score: 7.4/10. Published 2019-01-15.

How severe is CVE-2017-6924?

High severity. CVSS v3 base score is 7.4 out of 10.

Privilege escalation in Drupal

CVE-2017-6924

In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that…

Vulnerability class: Privilege Escalation

EPSS: 0.021 (79.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Drupal
Drupal Core — versions Drupal 8

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

mlhess@drupal.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
mlhess@drupal.org (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
mlhess@drupal.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)

Frequently asked questions

What is CVE-2017-6924?: CVE-2017-6924 is a high-severity vulnerability in Drupal, classified under Improper Privilege Management. CVSS score: 7.4/10. Published 2019-01-15.
How severe is CVE-2017-6924?: High severity. CVSS v3 base score is 7.4 out of 10.