CVE-2019-6340highunder attackCWE-502

CVE-2019-6340: high-severity vulnerability in Drupal Core

Drupal core - Highly critical - Remote Code Execution

Published · Updated

Follow this CVE+ Monitor Drupal core+ Monitor drupal/core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.1epss 92%
from disclosure to weapon1 day
Published on NVDFeb 21
1st PoC+1d
metasploitFeb 20
CISA KEV+1128d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

Drupal's REST API fails to properly clean data before processing it, allowing attackers to execute arbitrary PHP code on affected sites. This is critical because attackers can take complete control of the website without needing a user account.

Technical detail

Insufficient input sanitization in field type processing allows unsafe deserialization of untrusted data via REST/web services endpoints (PATCH/POST requests). Requires the REST module enabled or alternative web services module; exploitation leads to remote code execution with application privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Drupal · Drupal Core
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Drupal Core

In the same product, most dangerous first.

CVE-2020-13671HIGHCVE-2020-13671EPSS 36.2%KEVCVE-2017-6381—CVE-2017-6381EPSS 3.9%CVE-2020-13664—CVE-2020-13664EPSS 3.0%CVE-2020-13666—CVE-2020-13666EPSS 2.9%CVE-2019-6342—Drupal core - Critical - Access bypass - SA-CORE-2019-008EPSS 2.2%CVE-2017-6924—REST API can bypass comment approval - Access Bypass - Moderately CriticalEPSS 2.1%