CVE-2017-6930
In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated…
- Published
- Updated
- Reserved
- Assigned by
- drupal
Description
In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_access_records().
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | High8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.3% · top 30% of all CVEs (3 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.
Weakness
- Access bypass
Affected products
- affected 8.4.x versions before 8.4.5
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Packagistdrupal/coreGHSA-3327-jr93-7hq3 (opens in a new tab)
- Packagistdrupal/drupalGHSA-3327-jr93-7hq3 (opens in a new tab)
References (1)
- https://www.drupal.org/sa-core-2018-001 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-3327-jr93-7hq3 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2017-6930)Record last updated .