CVE-2017-6377

When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attached, resulting in an access bypass.

• CWE-863

• http://www.securityfocus.com/bid/96919Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038058
• https://www.drupal.org/SA-2017-001Vendor Advisory
• http://www.securityfocus.com/bid/96919Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038058
• https://www.drupal.org/SA-2017-001Vendor Advisory

Published

Mar 16, 2017

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6363In the GD Graphics Library (aka LibGD) through 2.2.5, there …8.1
• CVE-2017-6366Cross-site request forgery (CSRF) vulnerability in NETGEAR D…
• CVE-2017-6367In Cerberus FTP Server 8.0.10.1, a crafted HTTP request caus…
• CVE-2017-6369Insufficient checks in the UDF subsystem in Firebird 2.5.x b…8.8
• CVE-2017-6370TYPO3 7.6.15 sends an http request to an index.php?loginProv…
• CVE-2017-6371Synchronet BBS 3.16c for Windows allows remote attackers to …7.5
• CVE-2017-6379Some administrative paths in Drupal 8.2.x before 8.2.7 did n…
• CVE-2017-6381A 3rd party development library including with Drupal 8 deve…
• CVE-2017-6383Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-6384Memory leak in the login_user function in saslserv/main.c in…
• CVE-2017-6386Memory leak in the vrend_create_vertex_elements_state functi…6.5
• CVE-2017-6387The dex_loadcode function in libr/bin/p/bin_dex.c in radare2…