{"id":"GHSA-gxxq-fhc7-3jv9","aliases":["CVE-2017-6379"],"title":"Drupal Cross-Site Request Forgery (CSRF)","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.","severity":"high","score":7.5,"published":"2022-05-17T02:30:08.000Z","modified":"2024-04-23T22:41:48.754Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"drupal/core","sources":[{"name":"OSV · GHSA-gxxq-fhc7-3jv9","url":"https://osv.dev/vulnerability/GHSA-gxxq-fhc7-3jv9"}],"ranges":[{"events":[{"introduced":"8.2.0"},{"fixed":"8.2.7"}],"type":"ECOSYSTEM"}],"versions":["8.2.0","8.2.1","8.2.2","8.2.3","8.2.4","8.2.5","8.2.6"],"fixed":["8.2.7"]},{"ecosystem":"Packagist","name":"drupal/drupal","sources":[{"name":"OSV · GHSA-gxxq-fhc7-3jv9","url":"https://osv.dev/vulnerability/GHSA-gxxq-fhc7-3jv9"}],"ranges":[{"events":[{"introduced":"8.2.0"},{"fixed":"8.2.7"}],"type":"ECOSYSTEM"}],"versions":["8.2.0","8.2.1","8.2.2","8.2.3","8.2.4","8.2.5","8.2.6"],"fixed":["8.2.7"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2017-6379","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6379.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6379.yaml","https://github.com/drupal/core","https://www.drupal.org/SA-2017-001","http://www.securityfocus.com/bid/96919","http://www.securitytracker.com/id/1038058"],"sources":[{"name":"OSV","id":"GHSA-gxxq-fhc7-3jv9","modified":"2024-04-23T22:41:48.754007Z","url":"https://osv.dev/vulnerability/GHSA-gxxq-fhc7-3jv9"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.5}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T19:25:35.956Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}