GitHub Advisoryadvisory · Packagist
GHSA-6ccv-8fgf-cjpw Drupal core Denial of Service vulnerability
MEDIUM
Official page ↗
- Ecosystem
- Packagist
- Packages
- drupal/core
- Severity
- Moderate
- Reviewed
- 2024-02-12
Affected packages
• Packagist drupal/core: >= 8.0.0, < 10.1.8 → fixed in 10.1.8
• Packagist drupal/core: >= 10.2.0, < 10.2.2 → fixed in 10.2.2
Description
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).
Sites that do not use the Comment module are not affected.
References
- https://github.com/drupal/core/commit/2f76ac716ca8019bc60579fdfc8aa6cd65d57dff web
- https://github.com/drupal/core/commit/5e606b560ac4ecb08135f12b6165bbe0348346a0 web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2024-01-17.yaml web
- https://github.com/drupal/core package
- https://www.drupal.org/sa-core-2024-001 web