Drupal Arbitrary Code Execution in drupal/core
Summary
CVE-2016-3171: Drupal arbitrary code execution. Affects drupal/core versions >= 6.0, < 6.38. Fixed in 6.38. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The drupal/core package is a fundamental component of Drupal, containing core functionality and modules. This vulnerability affects Drupal versions 6.x before 6.38 when used with PHP versions before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13.
Vulnerability Detail
The vulnerability allows remote attackers to execute arbitrary code by exploiting a weakness related to session data truncation. When session data is truncated, it can lead to code execution, potentially resulting in unauthorized access, data breaches, or other malicious activities. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.1.
How To Fix
Minimum fixed version
6.38
This is the first release that contains the fix.
composer require drupal/core:6.38Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading Drupal and PHP to the specified versions.
Conclusion
The Drupal Arbitrary Code Execution vulnerability in drupal/core poses a significant risk to websites and applications using affected versions of Drupal and PHP. It is crucial to promptly upgrade Drupal and PHP to the recommended versions to mitigate the vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal is an open-source content management system (CMS) used for building websites and applications.
Drupal versions 6.x before 6.38 are affected when used with PHP versions before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13.
The vulnerability allows remote attackers to execute arbitrary code, potentially leading to unauthorized access, data breaches, or other malicious activities.
To fix this vulnerability, upgrade Drupal to version 6.38 or later and update PHP to version 5.4.45 or later for Drupal 6.x.
No, there is no known workaround for this vulnerability. Applying the recommended fix is necessary.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
