CVE-2017-6379

Description

Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.

How to fix CVE-2017-6379

To remediate CVE-2017-6379, upgrade the affected package to a fixed version below.

• Packagist/drupal/core—upgrade to 8.2.7 or later
• —upgrade to 8.2.7 or later

Is CVE-2017-6379 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• >= 8.2.0, < 8.2.7
• >= 8.2.0, < 8.2.7

CVSS scores

References (7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2017-6379
• PATCHgithub.com/drupal/core
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6379.yaml
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6379.yaml