High severity · published Jan 15, 2019
CVE-2017-6924
REST API can bypass comment approval - Access Bypass - Moderately Critical
7.4
CVSS
2.1%
EPSS
No
On KEV
Description
In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to post comments, or where anonymous users can post comments.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Drupal · Drupal
Drupal 8 before 8.3.7 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-6924
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-6924
Third Party Advisory
http://www.securityfocus.com/bid/100368
Third Party Advisory
http://www.securitytracker.com/id/1039200
Mitigation
https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple
More from Drupal
9.8
CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
9.8
CVE-2018-7602
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
9.8
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
8.8
CVE-2020-13671
Drupal core Un-restricted Upload of File
8.1
CVE-2019-6340
Drupal core - Highly critical - Remote Code Execution