GitHub Advisoryadvisory · Packagist

GHSA-rhx9-3qf7-r3j7 Drupal Remote code execution

HIGH Published 2022-05-13 Modified 2024-04-23 Official page ↗
Aliases
CVE-2017-6381
Ecosystem
Packagist
Packages
drupal/core, drupal/drupal
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-829
Reviewed
2024-04-23

Affected packages

• Packagist drupal/core: >= 8.0, < 8.2.7 → fixed in 8.2.7 • Packagist drupal/drupal: >= 8.0, < 8.2.7 → fixed in 8.2.7

Description

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the /vendor/phpunit directory from your production deployments

Related

Alias · CVE (1)

  • CVE-2017-6381 A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. vulnerability

Weakness · CWE (1)

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness

References