CVE-2017-6377

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2017-6377

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-6377.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-6377

Aliases

GHSA-w7qx-vwr9-2j3r

Published

2017-03-16T14:59:00.237Z

Modified

2026-07-08T12:28:06.689942Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.

References

Affected packages

Git / github.com/drupal/drupal

Affected ranges

Type

GIT

Repo

https://github.com/drupal/drupal

Events

Introduced

fb83de52e58e8fb3303de7aa9834f99ae128564a

Last affected

711288453bb031c0ad5324f5361339d51a8dd511

Database specific

{
    "extracted_events": [
        {
            "introduced": "8.2.0"
        },
        {
            "last_affected": "8.2.0"
        },
        {
            "introduced": "8.2.0-beta1"
        },
        {
            "last_affected": "8.2.0-beta1"
        },
        {
            "introduced": "8.2.0-beta2"
        },
        {
            "last_affected": "8.2.0-beta2"
        },
        {
            "introduced": "8.2.0-beta3"
        },
        {
            "last_affected": "8.2.0-beta3"
        },
        {
            "introduced": "8.2.0-rc1"
        },
        {
            "last_affected": "8.2.0-rc1"
        },
        {
            "introduced": "8.2.0-rc2"
        },
        {
            "last_affected": "8.2.0-rc2"
        },
        {
            "introduced": "8.2.1"
        },
        {
            "last_affected": "8.2.1"
        },
        {
            "introduced": "8.2.2"
        },
        {
            "last_affected": "8.2.2"
        },
        {
            "introduced": "8.2.3"
        },
        {
            "last_affected": "8.2.3"
        },
        {
            "introduced": "8.2.4"
        },
        {
            "last_affected": "8.2.4"
        },
        {
            "introduced": "8.2.5"
        },
        {
            "last_affected": "8.2.5"
        },
        {
            "introduced": "8.2.6"
        },
        {
            "last_affected": "8.2.6"
        }
    ],
    "source": "CPE_STRING",
    "cpe": [
        "cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*",
        "cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*",
        "cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*",
        "cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*",
        "cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:drupal:drupal:8.2.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:drupal:drupal:8.2.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:drupal:drupal:8.2.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:drupal:drupal:8.2.6:*:*:*:*:*:*:*"
    ]
}

Affected versions

8.*

8.2.0

8.2.0-beta1

8.2.0-beta2

8.2.0-beta3

8.2.0-rc1

8.2.0-rc2

8.2.1

8.2.2

8.2.3

8.2.4

8.2.5

8.2.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-6377.json"