Description

In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity.

Remediation

References

CVE-2017-6925

Related Vulnerabilities

PHP Resource Management Errors Vulnerability (CVE-2011-3267)

WordPress 5.7.x Multiple Prototype Pollution Vulnerabilities (5.7 - 5.7.5)

PostgreSQL Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-1170)

WordPress 4.7.x Directory Traversal (4.7 - 4.7.28)

Drupal Core Multiple Vulnerabilities (8.0.0 - 9.1.15)

Severity

Critical

Classification

CVE-2017-6925 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities