Vulnerability advisory

GHSA-gxxq-fhc7-3jv9

Drupal Cross-Site Request Forgery (CSRF)

Published May 17, 2022Updated Apr 23, 2024OSV record ↗

Also known as CVE-2017-6379

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected versions

drupal/core Packagist

All drupal/core advisories →

Affected	Fixed in
`8.2.0` to before 8.2.7	`8.2.7`Advisories →
Also listed as affected (7) `8.2.0` `8.2.1` `8.2.2` `8.2.3` `8.2.4` `8.2.5` `8.2.6`

drupal/drupal Packagist

All drupal/drupal advisories →

Affected	Fixed in
`8.2.0` to before 8.2.7	`8.2.7`Advisories →
Also listed as affected (7) `8.2.0` `8.2.1` `8.2.2` `8.2.3` `8.2.4` `8.2.5` `8.2.6`

Description

Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2017-6379 ↗
Webgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6379.yaml ↗
Webgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6379.yaml ↗
Packagegithub.com/drupal/core ↗
Webwww.drupal.org/SA-2017-001 ↗
Webwww.securityfocus.com/bid/96919 ↗
Webwww.securitytracker.com/id/1038058 ↗