Vulnerability advisory

GHSA-6g9h-6v79-w4pc

Drupal Users without "Administer comments" can set comment visibility on nodes they can edit

Published May 17, 2022Updated Apr 23, 2024OSV record ↗

Also known as CVE-2016-7570

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected versions

drupal/drupal Packagist

All drupal/drupal advisories →

Affected	Fixed in
`8.0.0` to before 8.1.10	`8.1.10`Advisories →
Also listed as affected (20) `8.0.0` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9`

drupal/core Packagist

All drupal/core advisories →

Affected	Fixed in
`8.0.0` to before 8.1.10	`8.1.10`Advisories →
Also listed as affected (20) `8.0.0` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9`

Description

Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.

GHSA-6g9h-6v79-w4pc

Affected versions

drupal/drupal Packagist

drupal/core Packagist

Description

References