Описание
In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity.
Ссылки
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- MitigationVendor Advisory
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- MitigationVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 8.0.0 (включая) до 8.3.7 (исключая)
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
EPSS
Процентиль: 71%
0.00683
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
NVD-CWE-noinfo
Связанные уязвимости
CVSS3: 9.8
debian
больше 6 лет назад
In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability ...
CVSS3: 9.8
github
около 3 лет назад
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
EPSS
Процентиль: 71%
0.00683
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
NVD-CWE-noinfo