Description
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/97941
Patch, Vendor Advisory x_refsource_confirm
https://www.drupal.org/SA-CORE-2017-002
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1038371
Scores
CVSS v3
7.5
EPSS
0.0060
EPSS Percentile
69.6%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
Status
published
Products (15)
drupal/core
8.0 - 8.2.8Packagist
drupal/drupal
8.0.0 (33 CPE variants)
drupal/drupal
8.0.1
drupal/drupal
8.0.2
drupal/drupal
8.0.3
drupal/drupal
8.0.4
drupal/drupal
8.0.5
drupal/drupal
8.0.6
drupal/drupal
8.1.0 (4 CPE variants)
drupal/drupal
8.1.1
... and 5 more
Published
Apr 20, 2017
Tracked Since
Feb 18, 2026