CVE-2017-6377 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 51%

Affected Products (NVD)

Vendor	Product	Version
drupal	drupal	8.2.0
drupal	drupal	8.2.0:beta1
drupal	drupal	8.2.0:beta2
drupal	drupal	8.2.0:beta3
drupal	drupal	8.2.0:rc1
drupal	drupal	8.2.0:rc2
drupal	drupal	8.2.1
drupal	drupal	8.2.2
drupal	drupal	8.2.3
drupal	drupal	8.2.4
drupal	drupal	8.2.5
drupal	drupal	8.2.6

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

drupal7

artful	ignored
bionic	dne
cosmic	dne
disco	dne
eoan	dne
focal	dne
groovy	dne
hirsute	dne
impish	dne
jammy	dne
kinetic	dne
lunar	dne
precise	ignored
trusty	not-affected
xenial	not-affected
yakkety	ignored
zesty	ignored

Common Weakness Enumeration

CWE-863 - Incorrect Authorization
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References

http://www.securityfocus.com/bid/96919

http://www.securitytracker.com/id/1038058

https://www.drupal.org/SA-2017-001

http://www.securityfocus.com/bid/96919

http://www.securitytracker.com/id/1038058

https://www.drupal.org/SA-2017-001