Description
Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.
Remediation
References
Related Vulnerabilities
Liferay Portal CVE-2020-13444 Vulnerability (CVE-2020-13444)
WebLogic CVE-2018-1257 Vulnerability (CVE-2018-1257)
WordPress 4.5.x Cross-Domain Flash Injection Vulnerability (4.5 - 4.5.12)
WordPress Plugin user files Arbitrary File Upload (2.4.2)
WordPress Plugin Site Offline Or Coming Soon Or Maintenance Mode Security Bypass (1.5.2)