CVE-2017-6921
MEDIUMDrupal 8.0.0-8.3.3 - Authenticated Arbitrary File Manipulation via REST File Resource
Title source: llmDescription
In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/99222
Mitigation, Vendor Advisory x_refsource_confirm
https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1038781
Scores
CVSS v3
5.9
EPSS
0.0044
EPSS Percentile
63.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-20
Status
published
Products (3)
drupal/core
8.0 - 8.3.4Packagist
drupal/drupal
8.0 - 8.3.4Packagist
drupal/drupal
8.0.0 - 8.3.4
Published
Jan 15, 2019
Tracked Since
Feb 18, 2026