In breve
- CVE-2017-6379 è una vulnerabilità ALTO (CVSS 7.5) che riguarda drupal/core, drupal/drupal, drupal (drupal).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.78%, superiore al 55.9% delle vulnerabilità.
- Correzione: aggiornare a 8.2.7 o successiva.
| Package | Affected versions | Patched versions |
|---|
| drupal/core Packagist | ≥ 8.2.0, < 8.2.7
| 8.2.7
|
| drupal/drupal Packagist | ≥ 8.2.0, < 8.2.7
| 8.2.7
|
| drupal | = 8.2.0= 8.2.1= 8.2.2= 8.2.3= 8.2.4= 8.2.5= 8.2.6
| No fix yet |
Description
Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.
NVD description
Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free