{"id":"CVE-2017-6379","details":"Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.","aliases":["GHSA-gxxq-fhc7-3jv9"],"modified":"2026-10-24T10:30:51.379365786Z","published":"2017-03-16T14:59:00.267Z","database_specific":{},"references":[{"type":"WEB","url":"http://www.securityfocus.com/bid/96919"},{"type":"WEB","url":"http://www.securitytracker.com/id/1038058"},{"type":"ADVISORY","url":"https://www.drupal.org/SA-2017-001"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/drupal/drupal","events":[{"introduced":"fb83de52e58e8fb3303de7aa9834f99ae128564a"},{"last_affected":"711288453bb031c0ad5324f5361339d51a8dd511"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"8.2.0"},{"last_affected":"8.2.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*"},{"range":[{"introduced":"8.2.0-beta1"},{"last_affected":"8.2.0-beta1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*","range":[{"introduced":"8.2.0-beta2"},{"last_affected":"8.2.0-beta2"}]},{"range":[{"introduced":"8.2.0-beta3"},{"last_affected":"8.2.0-beta3"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*","range":[{"introduced":"8.2.0-rc1"},{"last_affected":"8.2.0-rc1"}],"source":"CPE_STRING"},{"range":[{"introduced":"8.2.0-rc2"},{"last_affected":"8.2.0-rc2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*"},{"range":[{"introduced":"8.2.1"},{"last_affected":"8.2.1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:drupal:drupal:8.2.2:*:*:*:*:*:*:*","range":[{"introduced":"8.2.2"},{"last_affected":"8.2.2"}],"source":"CPE_STRING"},{"range":[{"introduced":"8.2.3"},{"last_affected":"8.2.3"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:drupal:drupal:8.2.3:*:*:*:*:*:*:*"},{"range":[{"introduced":"8.2.4"},{"last_affected":"8.2.4"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:drupal:drupal:8.2.4:*:*:*:*:*:*:*"},{"range":[{"introduced":"8.2.5"},{"last_affected":"8.2.5"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:drupal:drupal:8.2.5:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:drupal:drupal:8.2.6:*:*:*:*:*:*:*","range":[{"introduced":"8.2.6"},{"last_affected":"8.2.6"}],"source":"CPE_STRING"}]}}],"versions":["8.2.0","8.2.0-beta1","8.2.0-beta2","8.2.0-beta3","8.2.0-rc1","8.2.0-rc2","8.2.1","8.2.2","8.2.3","8.2.4","8.2.5","8.2.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-6379.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}