#VU6352 Privilege escalation in Drupal - CVE-2017-6919
Published: April 19, 2017 / Updated: May 1, 2017
Vulnerability identifier: #VU6352
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2017-6919
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Drupal
Drupal
Software vendor:
Drupal
Drupal
Description
The vulnerability allows a remote attacker to gain escalated privileges within web application.
The vulnerability exists due to undisclosed error related to RESTful Web Services. A remote authenticated attacker can send a specially crafted PATCH request and gain full access to vulnerable website.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable website.
Remediation
Update to version 8.2.8 or 8.3.1.