PT-2024-40130 · Drupal · Drupal Core

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: Drupal core (affected versions not specified)

Description: The issue is related to the sanitization of variables for shell arguments in the DefaultMailSystem::mail() function when sending email, which could potentially lead to remote code execution.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

GHSA-6MGP-V5CM-GHG5

Affected Products

Drupal Core

References · 4

• https://osv.dev/vulnerability/GHSA-6mgp-v5cm-ghg5 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2018-10-17-4.yaml · Note
• https://github.com/drupal/core · Note
• https://drupal.org/sa-core-2018-006 · Note