CVE-2017-6924 Information

Description

In Drupal 8 prior to 8.3.7; When using the REST API users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled the comment entity REST resource enabled and where an attacker can access a user account on the site with permissions to post comments or where anonymous users can post comments.

CVSS Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Reference

http://www.securityfocus.com/bid/100368 http://www.securitytracker.com/id/1039200 https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

NONE

Base Severity

7.4