CVE-2017-6924: REST API can bypass comment approval.
In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to post comments, or where anonymous users can post comments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 8.3.7 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.3.7 - Upgrade
Upgrade
Drupal 8to a version that resolves this vulnerability.Fixed in 8.3.7
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6924?
CVE-2017-6924 has been classified as a moderate severity vulnerability.
How do I fix CVE-2017-6924?
The vulnerability can be fixed by upgrading to Drupal version 8.3.7 or later.
Which versions of Drupal are affected by CVE-2017-6924?
CVE-2017-6924 affects Drupal versions prior to 8.3.7.
What specific component is vulnerable in CVE-2017-6924?
The vulnerability specifically affects the REST API in Drupal when the RESTful Web Services module is enabled.
Can unauthorized users exploit CVE-2017-6924?
Yes, users without the correct permissions can post approved comments via the REST API due to this vulnerability.