Drupal.org AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N

Drupal.org AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N

CWE-284
CWE-200

CWE-862

OR
     *cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* versions from (including) 8.0.0 up to (including) 8.3.7

(AV:N/AC:L/Au:S/C:P/I:N/A:N)

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-284

http://www.securityfocus.com/bid/100368 No Types Assigned

http://www.securityfocus.com/bid/100368 Third Party Advisory, VDB Entry

http://www.securitytracker.com/id/1039200 No Types Assigned

http://www.securitytracker.com/id/1039200 Third Party Advisory, VDB Entry

https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple No Types Assigned

https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-08-16/drupal-core-multiple Patch, Release Notes, Vendor Advisory

http://www.securityfocus.com/bid/100368 [No Types Assigned]

http://www.securitytracker.com/id/1039200 [No Types Assigned]

In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view.

It is best practice to always include some form of access restrictions on all views, even if you are using another module to display them.

In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view. It is best practice to always include some form of access restrictions on all views, even if you are using another module to display them.