CVE-2017-6379
CVE-2017-6379
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.
CVSS 7.5 · High · EPSS 0.8% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
drupal core
- Versions
- 8.2.x versions before 8.2.7: Affected
No fix published
drupal/core Packagist
- Versions
- 8.2.0
- 8.2.1
- 8.2.2
- 8.2.3
- 8.2.4
- 8.2.5
- 8.2.6
- Affected ranges
- ECOSYSTEM: ≥ 8.2.0, < 8.2.7
Update to 8.2.7
drupal/drupal Packagist
- Versions
- 8.2.0
- 8.2.1
- 8.2.2
- 8.2.3
- 8.2.4
- 8.2.5
- 8.2.6
- Affected ranges
- ECOSYSTEM: ≥ 8.2.0, < 8.2.7
Update to 8.2.7