‹ Back to list

CVE-2017-6920

Status: ModifiedCritical (9.8)—
Severity9.8Critical · CVSS 3.0
Exploitation probability20 %higher than 97% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.

CVSS

Base score
9.8
Version
3.0
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
20 %
Percentile among all scored CVEs
97
Score date
10/27/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Drupal — Drupal

CWEs

References

Show 6 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2017-6920",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "mlhess@drupal.org",
      "affectedData": [
        {
          "vendor": "Drupal.org",
          "product": "Drupal Core",
          "versions": [
            {
              "status": "affected",
              "version": "8 prior to 8.3.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-08-06T15:29:00.237",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/99211",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "mlhess@drupal.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1038781",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "mlhess@drupal.org"
    },
    {
      "url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "mlhess@drupal.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/99211",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1038781",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-19"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations."
    },
    {
      "lang": "es",
      "value": "Drupal core 8 en versiones anteriores a la 8.3.4 permite que los atacantes remotos ejecuten código arbitrario debido a que el analizador PECL YAML no maneja objetos PHP de forma segura durante determinadas operaciones."
    }
  ],
  "lastModified": "2026-06-17T01:23:20.130",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0C572FD-C76D-4714-85A3-5CFF9F292C2C",
              "versionEndExcluding": "8.3.4",
              "versionStartIncluding": "8.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org"
}