CVE-2017-6924
REST API can bypass comment approval - Access Bypass - Moderately Critical
- Published
- Updated
- Reserved
- Assigned by
- drupal
Description
In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to post comments, or where anonymous users can post comments.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | High7.4 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 2.1% · top 18% of all CVEs (3 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.4.
Weakness
- Access Bypass
- CWE-269 (opens in a new tab)Other CVEs with CWE-269
Affected products
Drupal · Drupal Core
- affected Drupal 8 – < 8.3.7
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Packagistdrupal/coreGHSA-p8g6-5mg7-9r5q (opens in a new tab)
- Packagistdrupal/drupalGHSA-p8g6-5mg7-9r5q (opens in a new tab)
References (3)
- 100368 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple (opens in a new tab)x_refsource_CONFIRMx_transferred
- 1039200 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-p8g6-5mg7-9r5q (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2017-6924)Record last updated .