Skip to content
Log inStart free trial

GHSA-p8g6-5mg7-9r5q CVE-2017-6924

Drupal REST API can bypass comment approval

High Packagist
Severity
7.4 / 10
High · CVSS 3.0
Exploit chance (EPSS)
2.10%
Chance of exploitation in the next 30 days. Higher than 81.73% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-269 Improper Privilege Management
Fix
Available
2 packages have a fixed version

Description

In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to post comments, or where anonymous users can post comments.

Affected versions

Packagist

PackageVulnerableFixed in
drupal/core
>= 8.0, < 8.3.7
8.3.7
drupal/drupal
>= 8.0, < 8.3.7
8.3.7

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

drupal/core Packagist → 8.3.7

composer
composer require drupal/core:^8.3.7

drupal/drupal Packagist → 8.3.7

composer
composer require drupal/drupal:^8.3.7

Severity breakdown

CVSS 3.0 7.4

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Weakness

CWE-269: Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

How to prevent it
  • Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
  • Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system.
  • Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Critical Known exploited Also affects drupal/core
CVE-2020-28949
Multiple vulnerabilities through filename manipulation in Archive_Tar
High Known exploited Also affects drupal/core
CVE-2020-13671
Drupal core Unrestricted Upload of File with Dangerous Type
High Known exploited Also affects drupal/core
CVE-2019-6340
Drupal Core Remote Code Execution Vulnerability
High Known exploited Also affects drupal/core
CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
Critical Known exploited Also affects drupal/core
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Critical Known exploited Also affects drupal/core
DRUPAL-CORE-2026-016
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
Not rated yet Also affects drupal/core
DRUPAL-CORE-2026-015
The Drupal core Link module provides a field type that can be used for internal and external URLs.
Not rated yet Also affects drupal/core
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor