CVE-2017-6921 json
File REST resource does not properly validate
published 2019-01-15 7 y ago modified 2026-06-17 4 mo ago also GHSA-h377-287m-w2r9 , EUVD-2022-4050
- cvss
- 5.9
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.8%
- EPSS 1.8% chance of exploitation in 30 days, percentile 79%
- public exploits
- 0
- none known
Summary
In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.
Patch / fix
- packagist drupal/core 8.3.4
- packagist drupal/drupal 8.3.4
- Drupal Drupal Core 8.3.4
Exploit prediction
1.83% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | drupal/core | >=8.0, <8.3.4 |
8.3.4 |
| packagist | drupal/drupal | >=8.0, <8.3.4 |
8.3.4 |
Affected products
- Drupal Drupal Core
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
drupal.org
/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple
web, mitigation, vendor-advisory
-
securityfocus.com
/bid/99222
vdb-entry, web, third-party-advisory
-
securitytracker.com
/id/1038781
vdb-entry, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2017-6921
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6921.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6921.yaml
web
-
github.com
/drupal/core
package
-
drupal.org
/SA-CORE-2017-003
web
Sources
- CVE List CVE-2017-6921
- GitHub Advisory GHSA-h377-287m-w2r9
- NVD CVE-2017-6921
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.