Drupal 8.2.3

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:drupal:drupal:8.2.3:*:*:*:*:*:*:*

part: a version: 8.2.3 update: *

VendorDrupal (5a354f1f-83c2-5c0e-b1bc-3ae1f55812de)
ProductDrupal (612296c4-e720-5b7c-a84e-56df4c337089)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:drupal/drupal purl2cpe 2026-06-01 10:11:36.333388
pkg:github/drupal/drupal purl2cpe 2026-06-01 10:11:36.333390

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2017-6919 vulnerable 2026-06-08 05:09:55.159834 Details available
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.
Published: 2017-04-20T02:43:00.000Z
Updated: 2024-08-05T15:49:02.380Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2017-6379 vulnerable 2026-06-08 05:09:51.165970 Details available
Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.
Published: 2017-03-16T14:00:00.000Z
Updated: 2024-08-05T15:25:49.262Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2017-6377 vulnerable 2026-06-08 05:09:51.163743 Details available
When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.
Published: 2017-03-16T14:00:00.000Z
Updated: 2024-08-05T15:25:49.267Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.