製品・ソフトウェアに関する情報

JVN脆弱性詳細

Drupal におけるアクセス制御に関する脆弱性

Title	Drupal におけるアクセス制御に関する脆弱性
Summary	Drupal には、アクセス制御に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 攻撃が行われる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 19, 2017, midnight
Registration Date	May 19, 2017, 2:40 p.m.
Last Update	May 19, 2017, 2:40 p.m.

CVSS3.0 : 重要
Score	7.5
Vector	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS2.0 : 警告
Score	6
Vector	AV:N/AC:M/Au:S/C:P/I:P/A:P

Affected System

Drupal

Drupal 8.2.8 未満の 8

Drupal 8.3.1 未満の 8.3

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-6919	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6919
National Vulnerability Database (NVD)
2	CVE-2017-6919	https://nvd.nist.gov/vuln/detail/CVE-2017-6919

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-284	https://cwe.mitre.org/data/definitions/284.html

ベンダー情報

No	Name	URL
Security advisories
1	DRUPAL-SA-CORE-2017-002	https://www.drupal.org/SA-CORE-2017-002

Change Log

No	Changed Details	Date of change
0	[2017年05月19日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2017-6919

Summary	Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.
Publication Date	April 20, 2017, 11:59 a.m.
Registration Date	Jan. 26, 2021, 1:27 p.m.
Last Update	Nov. 21, 2024, 12:30 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:drupal:drupal:8.2.5:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:alpha9::::::
cpe:2.3:a:drupal:drupal:8.2.0:::::::*
cpe:2.3:a:drupal:drupal:8.2.0:beta3::::::
cpe:2.3:a:drupal:drupal:8.2.3:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:beta12::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta15::::::
cpe:2.3:a:drupal:drupal:8.3.0:::::::*
cpe:2.3:a:drupal:drupal:8.1.0:rc1::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta3::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha11::::::
cpe:2.3:a:drupal:drupal:8.0.0:rc1::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta16::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha4::::::
cpe:2.3:a:drupal:drupal:8.1.2:::::::*
cpe:2.3:a:drupal:drupal:8.1.6:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:alpha3::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha2::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta4::::::
cpe:2.3:a:drupal:drupal:8.2.0:rc1::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha6::::::
cpe:2.3:a:drupal:drupal:8.2.0:beta2::::::
cpe:2.3:a:drupal:drupal:8.3.0:alpha1::::::
cpe:2.3:a:drupal:drupal:8.1.8:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:beta11::::::
cpe:2.3:a:drupal:drupal:8.1.9:::::::*
cpe:2.3:a:drupal:drupal:8.1.5:::::::*
cpe:2.3:a:drupal:drupal:8.1.10:::::::*
cpe:2.3:a:drupal:drupal:8.0.4:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:rc4::::::
cpe:2.3:a:drupal:drupal:8.0.5:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:beta6::::::
cpe:2.3:a:drupal:drupal:8.3.0:beta1::::::
cpe:2.3:a:drupal:drupal:8.2.7:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:alpha15::::::
cpe:2.3:a:drupal:drupal:8.1.0:beta1::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta7::::::
cpe:2.3:a:drupal:drupal:8.2.0:rc2::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha12::::::
cpe:2.3:a:drupal:drupal:8.1.3:::::::*
cpe:2.3:a:drupal:drupal:8.0.2:::::::*
cpe:2.3:a:drupal:drupal:8.0.3:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:beta2::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha14::::::
cpe:2.3:a:drupal:drupal:8.2.4:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:beta13::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha7::::::
cpe:2.3:a:drupal:drupal:8.1.0:beta2::::::
cpe:2.3:a:drupal:drupal:8.3.0:rc1::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta10::::::
cpe:2.3:a:drupal:drupal:8.2.6:::::::*
cpe:2.3:a:drupal:drupal:8.1.0:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:alpha13::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha10::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta1::::::
cpe:2.3:a:drupal:drupal:8.1.7:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:alpha8::::::
cpe:2.3:a:drupal:drupal:8.0.0:rc2::::::
cpe:2.3:a:drupal:drupal:8.2.1:::::::*
cpe:2.3:a:drupal:drupal:8.3.0:rc2::::::
cpe:2.3:a:drupal:drupal:8.0.1:::::::*
cpe:2.3:a:drupal:drupal:8.1.1:::::::*
cpe:2.3:a:drupal:drupal:8.1.4:::::::*
cpe:2.3:a:drupal:drupal:8.0.6:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:rc3::::::
cpe:2.3:a:drupal:drupal:8.2.2:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:alpha5::::::
cpe:2.3:a:drupal:drupal:8.2.0:beta1::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta9::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta14::::::
cpe:2.3:a:drupal:drupal:8.0.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/97941	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/97941	Third Party Advisory VDB Entry
3	http://www.securitytracker.com/id/1038371
4	http://www.securitytracker.com/id/1038371
5	https://www.drupal.org/SA-CORE-2017-002	Patch Vendor Advisory
6	https://www.drupal.org/SA-CORE-2017-002	Patch Vendor Advisory

Common Vulnerabilities List

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:drupal:drupal:8.2.5:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:alpha9::::::
cpe:2.3:a:drupal:drupal:8.2.0:::::::*
cpe:2.3:a:drupal:drupal:8.2.0:beta3::::::
cpe:2.3:a:drupal:drupal:8.2.3:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:beta12::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta15::::::
cpe:2.3:a:drupal:drupal:8.3.0:::::::*
cpe:2.3:a:drupal:drupal:8.1.0:rc1::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta3::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha11::::::
cpe:2.3:a:drupal:drupal:8.0.0:rc1::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta16::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha4::::::
cpe:2.3:a:drupal:drupal:8.1.2:::::::*
cpe:2.3:a:drupal:drupal:8.1.6:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:alpha3::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha2::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta4::::::
cpe:2.3:a:drupal:drupal:8.2.0:rc1::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha6::::::
cpe:2.3:a:drupal:drupal:8.2.0:beta2::::::
cpe:2.3:a:drupal:drupal:8.3.0:alpha1::::::
cpe:2.3:a:drupal:drupal:8.1.8:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:beta11::::::
cpe:2.3:a:drupal:drupal:8.1.9:::::::*
cpe:2.3:a:drupal:drupal:8.1.5:::::::*
cpe:2.3:a:drupal:drupal:8.1.10:::::::*
cpe:2.3:a:drupal:drupal:8.0.4:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:rc4::::::
cpe:2.3:a:drupal:drupal:8.0.5:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:beta6::::::
cpe:2.3:a:drupal:drupal:8.3.0:beta1::::::
cpe:2.3:a:drupal:drupal:8.2.7:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:alpha15::::::
cpe:2.3:a:drupal:drupal:8.1.0:beta1::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta7::::::
cpe:2.3:a:drupal:drupal:8.2.0:rc2::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha12::::::
cpe:2.3:a:drupal:drupal:8.1.3:::::::*
cpe:2.3:a:drupal:drupal:8.0.2:::::::*
cpe:2.3:a:drupal:drupal:8.0.3:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:beta2::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha14::::::
cpe:2.3:a:drupal:drupal:8.2.4:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:beta13::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha7::::::
cpe:2.3:a:drupal:drupal:8.1.0:beta2::::::
cpe:2.3:a:drupal:drupal:8.3.0:rc1::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta10::::::
cpe:2.3:a:drupal:drupal:8.2.6:::::::*
cpe:2.3:a:drupal:drupal:8.1.0:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:alpha13::::::
cpe:2.3:a:drupal:drupal:8.0.0:alpha10::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta1::::::
cpe:2.3:a:drupal:drupal:8.1.7:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:alpha8::::::
cpe:2.3:a:drupal:drupal:8.0.0:rc2::::::
cpe:2.3:a:drupal:drupal:8.2.1:::::::*
cpe:2.3:a:drupal:drupal:8.3.0:rc2::::::
cpe:2.3:a:drupal:drupal:8.0.1:::::::*
cpe:2.3:a:drupal:drupal:8.1.1:::::::*
cpe:2.3:a:drupal:drupal:8.1.4:::::::*
cpe:2.3:a:drupal:drupal:8.0.6:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:rc3::::::
cpe:2.3:a:drupal:drupal:8.2.2:::::::*
cpe:2.3:a:drupal:drupal:8.0.0:alpha5::::::
cpe:2.3:a:drupal:drupal:8.2.0:beta1::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta9::::::
cpe:2.3:a:drupal:drupal:8.0.0:beta14::::::
cpe:2.3:a:drupal:drupal:8.0.0:::::::*