Actively exploited · Published Feb 21, 2019 · Assigned by drupal
CVE-2019-6340Drupal core - Highly critical - Remote Code Execution
High 8.1 Exploited
In plain English
A high-severity unsafe deserialization in Drupal Core from Drupal. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). The chance it is exploited in the next 30 days is estimated at 92.0% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 15, 2022.
Official description
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | drupal/core | 8.5.11, 8.6.10 | DRUPAL-CORE-2019-003 |
| Packagist | drupal/core | 8.6.10 | GHSA-3gx6-h57h-rm27 |
| Packagist | drupal/core | 7.62.0 | GHSA-3gx6-h57h-rm27 |
| Packagist | drupal/core | 8.5.11 | GHSA-3gx6-h57h-rm27 |
| Packagist | drupal/drupal | 7.62.0 | GHSA-3gx6-h57h-rm27 |
| Packagist | drupal/drupal | 8.5.11 | GHSA-3gx6-h57h-rm27 |
| Packagist | drupal/drupal | 8.6.10 | GHSA-3gx6-h57h-rm27 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Drupal | Drupal Core | 8.5 – before 8.5.118.6 – before 8.6.10 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.synology.com/security/advisory/Synology_SA_19_09 x_refsource_CONFIRM
- 46452 exploit, x_refsource_EXPLOIT-DB
- https://www.drupal.org/sa-core-2019-003 x_refsource_CONFIRM
- 46510 exploit, x_refsource_EXPLOIT-DB
- 107106 vdb-entry, x_refsource_BID
- 46459 exploit, x_refsource_EXPLOIT-DB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340 government-resource