CVE-2017-6921
File REST resource does not properly validate
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.
En Drupal 8, en versiones anteriores a la 8.3.4, el recurso de archivo REST no valida correctamente algunos campos al manipular archivos. Un sitio solo se ve afectado por esto si tiene el módulo RESTful Web Services (rest) habilitado, el recurso de archivo REST habilitado, permite peticiones PATCH, y un atacante es capaz de obtener o registrar una cuenta de usuario en el sitio con permisos para subir archivos y modificar el recurso de archivo.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-03-16 CVE Reserved
- 2019-01-15 CVE Published
- 2024-08-10 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/99222 | Third Party Advisory | |
| http://www.securitytracker.com/id/1038781 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Drupal Search vendor "Drupal" | Drupal Search vendor "Drupal" for product "Drupal" | >= 8.0.0 < 8.3.4 Search vendor "Drupal" for product "Drupal" and version " >= 8.0.0 < 8.3.4" | - |
Affected
| ||||||