Drupal core Denial of Service vulnerability in drupal/core
Summary
GHSA-6ccv-8fgf-cjpw: Drupal core Denial of Service vulnerability. Affects drupal/core across 2 version ranges.
>= 8.0.0, < 10.1.8
>= 10.2.0, < 10.2.2
Fixed in 10.1.8 or 10.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal core is the main package of the Drupal content management system (CMS). It provides the fundamental functionality and features of Drupal. The Comment module is a part of Drupal core and allows users to reply to comments on a website. This module enables interaction and engagement between users. However, a vulnerability has been discovered in the Comment module that can lead to a denial of service (DOS) attack. This vulnerability affects versions 8.0.0 to 10.1.8 and versions 10.2.0 to 10.2.2 of the drupal/core package.
Vulnerability Detail
The vulnerability in the Comment module of Drupal core allows an attacker to trigger a denial of service (DOS) attack. By making specific comment reply requests, an attacker can overwhelm the system and cause it to become unresponsive or crash. This can disrupt the normal functioning of the website and impact its availability to users. It is important to note that sites not using the Comment module are not affected by this vulnerability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 10.1.810.1.8composer require drupal/core:10.1.8 -
>= 10.2.0, < 10.2.210.2.2composer require drupal/core:10.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, site administrators can disable the Comment module if it is not required for their website's functionality. By disabling the module, the vulnerability is effectively mitigated. However, this may impact the ability for users to engage in comment discussions on the website.
Conclusion
The Drupal core Denial of Service vulnerability in the Comment module can lead to a denial of service (DOS) attack on websites using affected versions of the drupal/core package. It is crucial to update the package to the recommended versions or disable the Comment module if not required. Regularly updating Drupal core and its modules is essential to ensure the security of the website. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Versions 8.0.0 to 10.1.8 and versions 10.2.0 to 10.2.2 of the drupal/core package are affected.
The vulnerability allows an attacker to trigger a denial of service (DOS) attack, potentially causing the website to become unresponsive or crash.
No, sites that do not use the Comment module are not affected by this vulnerability.
To fix this vulnerability, update the drupal/core package to the recommended versions mentioned in the 'how_to_fix' section.
Yes, site administrators can disable the Comment module as a workaround to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
