- Home
- CVEs with nessus.description==According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities :
- A flaw exists in the views subsystem due to a failure to restrict access to the Ajax endpoint to only views configured to use Ajax.
This is mitigated if you have access restrictions on the view.
(CVE-2017-6923)
- A flaw exists with REST API that allows users without the correct permission to post comments via REST that are approved even if the user does not have permission to post approved comments.
(CVE-2017-6924)
- A flaw exists in the entity access system that allows unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity. (CVE-2017-6925)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Max CVSS | 0 |
Min CVSS | 0 |
Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published |
Back to Top
Mark selected
Back to Top