Information disclosure in Drupal Core
Priority LOW 38CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the attacker must have permission to post comments.
Why it matters now
EPSS 0.01207 68th percentileScored 2026-11-07
Fix Fixed drupal/core (Packagist): 8.4.5, 7.57drupal/drupal (Packagist): 8.4.5, 7.57
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Drupal | Drupal Core | 8.4.x versions before 8.4.5 | — | No fix listed | CNA |
| — | drupal/core (Packagist) | 8.4.0 to before 8.4.5 | 8.4.5 | Patch available | GHSA-2p28-5mvp-2j2r |
| — | drupal/core (Packagist) | 7.0 to before 7.57 | 7.57 | Patch available | GHSA-2p28-5mvp-2j2r |
| — | drupal/drupal (Packagist) | 8.4.0 to before 8.4.5 | 8.4.5 | Patch available | GHSA-2p28-5mvp-2j2r |
| — | drupal/drupal (Packagist) | 7.0 to before 7.57 | 7.57 | Patch available | GHSA-2p28-5mvp-2j2r |
- Drupal Core VendorDrupal Affected 8.4.x versions before 8.4.5 Fixed in — No fix listed CNA
- drupal/core (Packagist) Vendor— Affected 8.4.0 to before 8.4.5 Fixed in 8.4.5 Patch available GHSA-2p28-5mvp-2j2r
- drupal/core (Packagist) Vendor— Affected 7.0 to before 7.57 Fixed in 7.57 Patch available GHSA-2p28-5mvp-2j2r
- drupal/drupal (Packagist) Vendor— Affected 8.4.0 to before 8.4.5 Fixed in 8.4.5 Patch available GHSA-2p28-5mvp-2j2r
- drupal/drupal (Packagist) Vendor— Affected 7.0 to before 7.57 Fixed in 7.57 Patch available GHSA-2p28-5mvp-2j2r
Remediation
- Fix · GHSA-2p28-5mvp-2j2r drupal/core (Packagist) Fixed in 8.4.5 Advisory →
- Fix · GHSA-2p28-5mvp-2j2r drupal/core (Packagist) Fixed in 7.57 Advisory →
- Fix · GHSA-2p28-5mvp-2j2r drupal/drupal (Packagist) Fixed in 8.4.5 Advisory →
- Fix · GHSA-2p28-5mvp-2j2r drupal/drupal (Packagist) Fixed in 7.57 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2017-6926
- 2026-10-03 Alias added: GHSA-2p28-5mvp-2j2r
References
More Drupal vulnerabilities
- TI-2026-07979 Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 KEVCVSS 3.1CRITICAL 9.8
- TI-2018-05494 Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 KEVCVSS 3.1CRITICAL 9.8
- TI-2018-05493 Improper input validation in Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-10731 Unrestricted file upload in Drupal Core KEVCVSS 3.1HIGH 8.8
- TI-2019-04505 Drupal core - Highly critical - Remote Code Execution KEVCVSS 3.1HIGH 8.1
- TI-2020-17477 Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks… KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2017-6926 · CVE Program
- CVE-2017-6926 · NVD
- FIRST EPSS
- GHSA-2p28-5mvp-2j2r · GitHub Advisory Database · CC BY 4.0
- CVE-2017-6926 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences