CVE-2017-6919
Drupal access control bypass vulnerability
CVE-2017-6919 is a high vulnerability (CVSS 7.5) in Drupal, published April 20, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.61%, the 76th percentile. Fixed in drupal/core 8.2.8.
- Severity
- 7.5 HighCVSS 3.0, NVD
- Exploit chance
- 1.61%EPSS, 76th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
8.2.8drupal/core +5 more
Description
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/corePackagist | 8.0 up to 8.2.8 | 8.2.8 |
drupal/corePackagist | 8.3.0 up to 8.3.1 | 8.3.1 |
drupal/drupalPackagist | 8.0 up to 8.2.8 | 8.2.8 |
drupal/drupalPackagist | 8.3.0 up to 8.3.1 | 8.3.1 |
drupal/corePackagist | 8.0 up to 8.2.8, plus listed versions 8.0.08.0.0-beta108.0.0-beta118.0.0-beta128.0.0-beta13 Show 44 moreShow less8.0.0-beta148.0.0-beta158.0.0-beta168.0.0-beta68.0.0-beta78.0.0-beta88.0.0-beta98.0.0-rc18.0.0-rc28.0.0-rc38.0.0-rc48.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.7 | 8.2.8 |
drupal/drupalPackagist | 8.0 up to 8.2.8, plus listed versions 8.0.08.0.0-alpha148.0.0-alpha158.0.0-beta18.0.0-beta10 Show 45 moreShow less8.0.0-beta118.0.0-beta128.0.0-beta138.0.0-beta148.0.0-beta158.0.0-beta168.0.0-beta28.0.0-beta38.0.0-beta48.0.0-beta58.0.0-beta68.0.0-beta78.0.0-beta98.0.0-rc18.0.0-rc28.0.0-rc38.0.0-rc48.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.2 | 8.2.8 |
What each source reports
NVD Score used
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.
- Record
CVE-2017-6919- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.
- Record
CVE-2017-6919- Updated
- 2026-11-02
EUVDEUVD-2022-2803No score
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.
- Record
EUVD-2022-2803- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6hpj-9xj7-2jxx
Drupal access control bypass vulnerability
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.
- Record
GHSA-6hpj-9xj7-2jxx- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.
- Record
CVE-2017-6919- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-6hpj-9xj7-2jxx
Drupal access control bypass vulnerability
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.
- Record
GHSA-6hpj-9xj7-2jxx- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/97941
drupal.org/SA-CORE-2017-002
securitytracker.com/id/1038371
nvd.nist.gov/vuln/detail/CVE-2017-6919
github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6919.yaml
Left out here: 5 versions. The JSON record has them.