Description
Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Drupal | Drupal Core | 8.2.x versions before 8.2.7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 8.2.0, < 8.2.7 | 8.2.7 | GHSA-gxxq-fhc7-3jv9 |
| Packagist | drupal/drupal | >= 8.2.0, < 8.2.7 | 8.2.7 | GHSA-gxxq-fhc7-3jv9 |
References
- 1038058 vdb-entry
- https://www.drupal.org/SA-2017-001
- 96919 vdb-entry