GCVE - cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*

part: a version: 8.2.1 update: *

Vendor	Drupal (`5a354f1f-83c2-5c0e-b1bc-3ae1f55812de`)
Product	Drupal (`612296c4-e720-5b7c-a84e-56df4c337089`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:drupal/drupal`	purl2cpe	2026-06-01 10:11:36.333383
`pkg:github/drupal/drupal`	purl2cpe	2026-06-01 10:11:36.333384

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-6919`	vulnerable	2026-06-08 05:09:55.159716	Details available Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests. Published: 2017-04-20T02:43:00.000Z Updated: 2024-08-05T15:49:02.380Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/97941 https://www.drupal.org/SA-CORE-2017-002 http://www.securitytracker.com/id/1038371	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-6381`	vulnerable	2026-06-08 05:09:51.197432	Details available A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the <siteroot>/vendor/phpunit directory from your production deployments Published: 2017-03-16T14:00:00.000Z Updated: 2024-08-05T15:25:49.286Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1038058 https://www.drupal.org/SA-2017-001 http://www.securityfocus.com/bid/96919	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-6379`	vulnerable	2026-06-08 05:09:51.165938	Details available Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID. Published: 2017-03-16T14:00:00.000Z Updated: 2024-08-05T15:25:49.262Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1038058 https://www.drupal.org/SA-2017-001 http://www.securityfocus.com/bid/96919	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-6377`	vulnerable	2026-06-08 05:09:51.162719	Details available When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass. Published: 2017-03-16T14:00:00.000Z Updated: 2024-08-05T15:25:49.267Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1038058 https://www.drupal.org/SA-2017-001 http://www.securityfocus.com/bid/96919	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9452`	vulnerable	2026-06-08 05:08:23.920987	Details available The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL. Published: 2016-11-25T18:00:00.000Z Updated: 2024-08-06T02:50:38.539Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/94367 https://www.drupal.org/SA-CORE-2016-005	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9450`	vulnerable	2026-06-08 05:08:23.917324	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9449`	vulnerable	2026-06-08 05:08:23.883501	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.