CVE-2017-6925: Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
Summary
CVE-2017-6925: Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions. Affects drupal/core versions >= 8.0, < 8.3.7. Fixed in 8.3.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The Drupal core package is the foundation of the CMS and includes essential functionality. This vulnerability affects Drupal core versions prior to 8.3.7. The entity access system in Drupal allows controlling access to entities, such as nodes, users, and taxonomy terms. Entities without UUIDs or with protected revisions are susceptible to unauthorized access. UUIDs are unique identifiers assigned to entities, and protected revisions have different access restrictions. This vulnerability can lead to unwanted access to view, create, update, or delete entities with these characteristics.
Vulnerability Detail
The vulnerability arises from a flaw in the entity access system of Drupal 8 core versions prior to 8.3.7. It allows unauthorized access to entities that do not use or do not have UUIDs, as well as entities with different access restrictions on different revisions. An attacker could exploit this vulnerability to gain access to sensitive information, modify content, or perform actions reserved for privileged users. The impact of this vulnerability depends on the specific entities affected and the access restrictions in place. It is crucial to update to Drupal core version 8.3.7 or later to mitigate this vulnerability.
How To Fix
Minimum fixed version
8.3.7
This is the first release that contains the fix.
composer require drupal/core:8.3.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround can be implemented. Administrators can manually assign UUIDs to entities that do not have them. This can be done by using Drupal's entity API or through custom code. By assigning UUIDs, the entities will no longer be vulnerable to this specific issue. However, it is still recommended to update to the latest secure release as soon as possible.
Conclusion
The vulnerability in Drupal core versions prior to 8.3.7 allows unauthorized access to entities without UUIDs or with protected revisions. It is crucial to update to the latest secure release to mitigate this vulnerability. If immediate updating is not possible, manually assigning UUIDs to vulnerable entities can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
This vulnerability affects Drupal core versions prior to 8.3.7.
Entities that do not use or do not have UUIDs, and entities with different access restrictions on different revisions are vulnerable.
An attacker could gain unauthorized access to entities, view sensitive information, modify content, or perform actions reserved for privileged users.
To fix this vulnerability, update the Drupal core package to version 8.3.7 or a later secure release.
Yes, a temporary workaround is to manually assign UUIDs to entities that do not have them.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
