CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2019-02-21
Drupal Core Remote Code Execution (RCE) Vulnerability Advisory (CVE-2019-6340)
[Affected Scope] Drupal 8.5.x before 8.5.11, Drupal 8.6.x before 8.6.10, and Drupal 7 environments utilizing web services modules such as RESTful Web Services or JSON:API
[Impact] Unauthenticated remote attackers can execute arbitrary PHP code on the target server by sending specially crafted REST API requests, potentially leading to full system compromise
[Mitigation] Immediately upgrade Drupal Core to the latest secure versions (8.5.11, 8.6.10, or later) or disable vulnerable REST/JSON:API modules as a temporary workaround