CVE-2017-6923: Access bypass in Drupal 8 views
In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view. It is best practice to always include some form of access restrictions on all views, even if you are using another module to display them.
Other sources
Views does not properly restrict access to the Ajax endpoint.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6923?
CVE-2017-6923 is considered a moderate severity vulnerability in Drupal.
How do I fix CVE-2017-6923?
To fix CVE-2017-6923, update your Drupal installation to version 8.3.7 or later.
What versions of Drupal are affected by CVE-2017-6923?
CVE-2017-6923 affects Drupal 8.x versions prior to 8.3.7.
What are the implications of CVE-2017-6923?
CVE-2017-6923 may allow unauthorized users to access Ajax endpoints of views that do not have proper access restrictions.
Is my site vulnerable to CVE-2017-6923?
If you are running a version of Drupal older than 8.3.7, your site is vulnerable to CVE-2017-6923.