Bug 1483975 (CVE-2017-6923, CVE-2017-6924, CVE-2017-6925) - CVE-2017-6923 CVE-2017-6924 CVE-2017-6925 drupal8: Multiple Vulnerabilities - SA-CORE-2017-004
Summary: CVE-2017-6923 CVE-2017-6924 CVE-2017-6925 drupal8: Multiple Vulnerabilities -...
Alias: CVE-2017-6923, CVE-2017-6924, CVE-2017-6925
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1483976
TreeView+ depends on / blocked
Reported: 2017-08-22 12:11 UTC by Adam Mariš
Modified: 2019-09-29 14:19 UTC (History)
2 users (show)

Fixed In Version: drupal 8.3.7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2017-09-18 20:47:30 UTC

Attachments (Terms of Use)

Description Adam Mariš 2017-08-22 12:11:54 UTC
Follwowing vulnerabilities have been addressed in Drupal 8.3.7:

* Views - Access Bypass - Moderately Critical - Drupal 8 - CVE-2017-6923:

 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view.

It is best practice to always include some form of access restrictions on all views, even if you are using another module to display them.

* REST API can bypass comment approval - Access Bypass - Moderately Critical - Drupal 8 - CVE-2017-6924:

 When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments.

This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to post comments, or where anonymous users can post comments.

* Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical - Drupal 8 - CVE-2017-6925:

There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity.



Comment 1 Adam Mariš 2017-08-22 12:12:05 UTC
Created drupal8 tracking bugs for this issue:

Affects: fedora-all [bug 1483976]

Comment 2 Shawn Iwinski 2017-09-18 18:28:38 UTC
All dependent bugs have been closed.  Can this bug be closed?

Comment 3 Adam Mariš 2017-09-18 20:47:30 UTC
(In reply to Shawn Iwinski from comment #2)
> All dependent bugs have been closed.  Can this bug be closed?

Sure, thanks!

Note You need to log in before you can comment on or make changes to this bug.