GCVE - cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*

part: a version: 8.2.2 update: *

Vendor	Drupal (`5a354f1f-83c2-5c0e-b1bc-3ae1f55812de`)
Product	Drupal (`612296c4-e720-5b7c-a84e-56df4c337089`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:drupal/drupal`	purl2cpe	2026-06-01 10:11:36.333386
`pkg:github/drupal/drupal`	purl2cpe	2026-06-01 10:11:36.333387

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-6919`	vulnerable	2026-06-08 05:09:55.159733	Details available Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests. Published: 2017-04-20T02:43:00.000Z Updated: 2024-08-05T15:49:02.380Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/97941 https://www.drupal.org/SA-CORE-2017-002 http://www.securitytracker.com/id/1038371	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-6379`	vulnerable	2026-06-08 05:09:51.165955	Details available Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID. Published: 2017-03-16T14:00:00.000Z Updated: 2024-08-05T15:25:49.262Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1038058 https://www.drupal.org/SA-2017-001 http://www.securityfocus.com/bid/96919	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-6377`	vulnerable	2026-06-08 05:09:51.163227	Details available When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass. Published: 2017-03-16T14:00:00.000Z Updated: 2024-08-05T15:25:49.267Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1038058 https://www.drupal.org/SA-2017-001 http://www.securityfocus.com/bid/96919	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9452`	vulnerable	2026-06-08 05:08:23.921005	Details available The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL. Published: 2016-11-25T18:00:00.000Z Updated: 2024-08-06T02:50:38.539Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/94367 https://www.drupal.org/SA-CORE-2016-005	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9450`	vulnerable	2026-06-08 05:08:23.917342	Details available The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context. Published: 2016-11-25T18:00:00.000Z Updated: 2024-08-06T02:50:38.330Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/94367 https://www.drupal.org/SA-CORE-2016-005	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-9449`	vulnerable	2026-06-08 05:08:23.883964	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.