Drupal · Core
CVE-2019-6340
Drupal core - Highly critical - Remote Code Execution
这是什么
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)
CISA: In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.
该怎么做
Apply updates per vendor instructions.
美国联邦机构的修复期限：2022年4月15日
Drupal 的其他被利用漏洞
| 加入日期 | 漏洞 | 产品 | 严重程度 | 受攻击概率 |
|---|---|---|---|---|
| 2026年5月22日 | SQL Injection | Core | 严重 9.8 | 89% |
| 2022年4月13日 | Remote Code Execution | Core | 高 8.1 | 99.2% |
| 2022年1月18日 | core Un-restricted Upload of File | Drupal core | 高 8.8 | 36% |
| 2021年11月3日 | Core Remote Code Execution | Drupal Core | 严重 9.8 | >99.9% |
来源：Known Exploited Vulnerabilities（CISA，公有领域）、CVE records（cve.org）和 EPSS（FIRST）。受攻击概率是 EPSS 对未来 30 天内有人尝试利用该漏洞的估计。