Kurz gesagt
- CVE-2017-6379 ist eine Schwachstelle (HOCH (CVSS 7.5)) in drupal/core, drupal/drupal, drupal (drupal).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.78%, höher als bei 55.9% aller Schwachstellen.
- Abhilfe: auf 8.2.7 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| drupal/core Packagist | ≥ 8.2.0, < 8.2.7
| 8.2.7
|
| drupal/drupal Packagist | ≥ 8.2.0, < 8.2.7
| 8.2.7
|
| drupal | = 8.2.0= 8.2.1= 8.2.2= 8.2.3= 8.2.4= 8.2.5= 8.2.6
| No fix yet |
Description
Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.
NVD description
Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free