PT-2017-17026 · Drupal · Drupal

Timo Hilsdorf · Publicado 2017-03-16 · Atualizado 2022-05-13 · CVE-2017-6381

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 8.2.2

Description A third-party development library included with Drupal 8 development dependencies is susceptible to remote code execution. However, this issue is mitigated by the default .htaccess protection against PHP execution and the fact that Composer development dependencies are not normally installed.

Recommendations For versions prior to 8.2.2, consider removing the /vendor/phpunit directory from production deployments to mitigate the risk.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-829

Identificadores relacionados

CVE-2017-6381

GHSA-RHX9-3QF7-R3J7

Produtos afetados

Drupal

Referências · 12

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6381.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6381.yaml · Exploit
• https://github.com/drupal/core · Nota
• https://drupal.org/SA-2017-001 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-rhx9-3qf7-r3j7 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6381 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-6381 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-6381 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6381 · Nota de Segurança
• http://securitytracker.com/id/1038058 · Nota
• https://ubuntu.com/security/CVE-2017-6381 · Aviso do Fabricante
• http://securityfocus.com/bid/96919 · Nota