// For flags

CVE-2017-6924

REST API can bypass comment approval - Access Bypass - Moderately Critical

Severity Score

7.4
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to post comments, or where anonymous users can post comments.

Al emplear la API REST en Drupal 8, en versiones anteriores a la 8.3.4, los usuarios que carezcan del permiso correcto pueden publicar comentarios mediante REST que están aprobados incluso aunque dicho usuario no tenga permiso para publicar comentarios aprobados. Este problema solo afecta a sitios que tengan el módulo RESTful Web Services (rest) habilitado, el recurso REST de comentario habilitado y si un atacante puede acceder a una cuenta de usuario en el sitio con permisos para publicar comentarios (o donde los usuarios anónimos puedan publicar comentarios).

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-03-16 CVE Reserved
  • 2019-01-15 CVE Published
  • 2024-09-16 CVE Updated
  • 2024-10-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-269: Improper Privilege Management
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Drupal
Search vendor "Drupal"
 Drupal
Search vendor "Drupal" for product "Drupal"
 >= 8.0.0 < 8.3.7
Search vendor "Drupal" for product "Drupal" and version " >= 8.0.0 < 8.3.7"
-
Affected