Privilege escalation in Drupal - CVE-2017-6919
Published: April 19, 2017 / Updated: May 1, 2017
Vulnerability identifier: #VU6352
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-6919
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain escalated privileges within web application.
The vulnerability exists due to undisclosed error related to RESTful Web Services. A remote authenticated attacker can send a specially crafted PATCH request and gain full access to vulnerable website.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable website.
Affected software
Drupal
Fedora
drupal8
Fedora
drupal8
How to mitigate CVE-2017-6919
Update to version 8.2.8 or 8.3.1.
drupal8 - addressed in versions 8.3.1-1.fc24, 8.3.1-1.fc25, 8.3.1-1.fc26