Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2017-6379

Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated b

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
drupal

Description

Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Drupal Drupal Core

  • 8.2.x versions before 8.2.7affected

References