{"api_version":"1","generated_at":"2026-07-23T06:38:16+00:00","cve":"CVE-2017-6921","urls":{"html":"https://cve.report/CVE-2017-6921","api":"https://cve.report/api/cve/CVE-2017-6921.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-6921","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-6921"},"summary":{"title":"CVE-2017-6921","description":"In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.","state":"PUBLIC","assigner":"security@drupal.org","published_at":"2019-01-15 21:29:00","updated_at":"2023-11-07 02:49:00"},"problem_types":["CWE-20"],"metrics":[],"references":[{"url":"http://www.securityfocus.com/bid/99222","name":"99222","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"Drupal Core CVE-2017-6921 Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple","name":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple","refsource":"CONFIRM","tags":["Mitigation","Vendor Advisory"],"title":"Drupal Core - Multiple Vulnerabilities - SA-CORE-2017-003 | Drupal.org","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1038781","name":"1038781","refsource":"SECTRACK","tags":["Third Party Advisory","VDB Entry"],"title":"Drupal Bugs Let Remote Users Access Certain Uploaded Files and Execute Arbitrary Code - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-6921","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6921","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"6921","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"drupal","cpe5":"drupal","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"6921","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"drupal","cpe5":"drupal","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"AKA":"","ASSIGNER":"security@drupal.org","DATE_PUBLIC":"","ID":"CVE-2017-6921","STATE":"PUBLIC","TITLE":"File REST resource does not properly validate "},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Drupal Core","version":{"version_data":[{"affected":"<","platform":"","version_name":"Drupal 8","version_value":"8.3.4"}]}}]},"vendor_name":"Drupal"}]}},"configuration":[],"credit":[],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource."}]},"exploit":[],"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":0,"baseSeverity":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Access Bypass"}]}]},"references":{"reference_data":[{"name":"99222","refsource":"BID","url":"http://www.securityfocus.com/bid/99222"},{"name":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple","refsource":"CONFIRM","url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple"},{"name":"1038781","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1038781"}]},"solution":[],"source":{"advisory":"SA-CORE-2017-003","defect":[],"discovery":"UNKNOWN"},"work_around":[]},"nvd":{"publishedDate":"2019-01-15 21:29:00","lastModifiedDate":"2023-11-07 02:49:00","problem_types":["CWE-20"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.2,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.3.4","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"6921","Ordinal":"103615","Title":"CVE-2017-6921","CVE":"CVE-2017-6921","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"6921","Ordinal":"1","NoteData":"In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.","Type":"Description","Title":null},{"CveYear":"2017","CveId":"6921","Ordinal":"2","NoteData":"2019-01-15","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"6921","Ordinal":"3","NoteData":"2019-01-16","Type":"Other","Title":"Modified"}]}}}