CVE-2017-6377
At a glance Severity Not available EPSS EPSS 1.89 % · percentile 79 (2026-10-28) State PUBLISHED Published 2017-03-16 Updated 2024-08-05 Assigner drupal NVD status Modified Description When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.
Scores Version Score Vector Scored by CVSS 3.0 HIGH 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N NVD · nvd@nist.gov (Primary) CVSS 2.0 MEDIUM 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
Advisories
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:8.2.3:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:8.2.4:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:8.2.5:*:*:*:*:*:*:*cpe:2.3:a:drupal:drupal:8.2.6:*:*:*:*:*:*:*Affected products
References
Sources
