Drupal 8.x < 8.3.7 Multiple Vulnerabilities

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

• A flaw exists in the views subsystem due to a failure to restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view. (CVE-2017-6923)

• A flaw exists with REST API that allows users without the correct permission to post comments via REST that are approved even if the user does not have permission to post approved comments. (CVE-2017-6924)

• A flaw exists in the entity access system that allows unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different access restrictions on different revisions of the same entity. (CVE-2017-6925)

Note that the scanner has not tested for these issues but has instead relied only on the application’s self-reported version number.