This is a critical access bypass vulnerability. A site is only affected by this if all of the following conditions are met:
* The site has the RESTful Web Services (`rest`) module enabled.
* The site allows `PATCH` requests.
* An attacker can get or register a user account on the site.
While we don't normally provide security releases for [unsupported minor releases](https://www.drupal.org/core/release-cycle-overview), given the potential severity of this issue, we have also provided an 8.2.x release to ensure that sites that have not had a chance to update to 8.3.0 can update safely.
京公网安备 11010502034610号
暂无评论