Drupal · Core
CVE-2019-6340
Drupal core - Highly critical - Remote Code Execution
De quoi s'agit-il
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)
CISA: In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.
Que faire
Apply updates per vendor instructions.
Échéance pour les agences fédérales américaines : 15 avril 2022
Autres failles exploitées chez Drupal
| Ajouté | Faille | Produit | Gravité | Risque d'attaque |
|---|---|---|---|---|
| 22 mai 2026 | SQL Injection | Core | Critique 9,8 | 89% |
| 13 avr. 2022 | Remote Code Execution | Core | Élevé 8,1 | 99,2% |
| 18 janv. 2022 | core Un-restricted Upload of File | Drupal core | Élevé 8,8 | 36% |
| 3 nov. 2021 | Core Remote Code Execution | Drupal Core | Critique 9,8 | >99,9% |
Sources : Known Exploited Vulnerabilities (CISA, domaine public), CVE records (cve.org) et EPSS (FIRST). Le risque d'attaque est l'estimation EPSS qu'une personne tente d'exploiter la faille dans les 30 prochains jours.