CVE-2017-6379

Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF

published March 16, 2017

CVSS
—
EPSS
1%
Percentile
55.4
In the wild
Unconfirmed
What it is

Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00780 · 55.4th percentile
Published
2017-03-16T14:00Z
EPSS history
Timeline
  • 16 MAR 14:00Z
    Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF
    cvelistv5