PT-2017-17026 · Drupal · Drupal

Timo Hilsdorf · Published 2017-03-16 · Updated 2022-05-13 · CVE-2017-6381

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 8.2.2

Description A third-party development library included with Drupal 8 development dependencies is susceptible to remote code execution. However, this issue is mitigated by the default .htaccess protection against PHP execution and the fact that Composer development dependencies are not normally installed.

Recommendations For versions prior to 8.2.2, consider removing the /vendor/phpunit directory from production deployments to mitigate the risk.

Exploit

Fix

RCE

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2017-6381

GHSA-RHX9-3QF7-R3J7

Affected Products

Drupal

References · 12

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6381.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6381.yaml · Exploit
• https://drupal.org/SA-2017-001 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rhx9-3qf7-r3j7 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6381 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-6381 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6381 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6381 · Security Note
• https://ubuntu.com/security/CVE-2017-6381 · Vendor Advisory
• https://github.com/drupal/core · Note
• http://securitytracker.com/id/1038058 · Note
• http://securityfocus.com/bid/96919 · Note