Drupal core Denial of Service
Summary
GHSA-pr99-c33p-fwf6: Drupal core Denial of Service. Affects drupal/core across 2 version ranges.
>= 8.0.0, < 8.7.11
>= 8.8.0, < 8.8.1
Fixed in 8.7.11 or 8.8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal core is a content management system (CMS) that allows users to easily create and manage websites. It provides a wide range of features and functionalities for building and maintaining websites. However, a vulnerability has been discovered in Drupal core that can lead to a Denial of Service (DoS) attack. This vulnerability affects versions 8.0.0 to 8.7.11 and 8.8.0 to 8.8.1 of the Drupal core package.
Vulnerability Detail
The vulnerability in Drupal core is triggered when a user visits the install.php page. This can cause cached data to become corrupted, resulting in impaired site performance until the caches are rebuilt. While this vulnerability does not directly lead to unauthorized access or data breaches, it can disrupt the normal functioning of the affected Drupal websites.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.118.7.11composer require drupal/core:8.7.11 -
>= 8.8.0, < 8.8.18.8.1composer require drupal/core:8.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the install.php page to prevent potential exploitation of the vulnerability. This can be done by removing or renaming the install.php file in the Drupal core installation directory. However, this workaround should only be considered as a temporary measure until the package is updated to a patched version.
Conclusion
In conclusion, the Drupal core package is vulnerable to a Denial of Service (DoS) attack that can be triggered by visiting the install.php page. This vulnerability can cause cached data corruption and impair site performance. It is recommended to update the Drupal core package to the patched versions mentioned above or apply the temporary workaround until the update is performed. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal core is a content management system (CMS) that allows users to create and manage websites.
A Denial of Service (DoS) attack is an attempt to disrupt the normal functioning of a network, system, or website by overwhelming it with a flood of illegitimate requests or excessive resource consumption.
This vulnerability can cause cached data to become corrupted, resulting in impaired site performance until the caches are rebuilt. It does not directly lead to unauthorized access or data breaches.
To fix this vulnerability, update the Drupal core package to the recommended patched versions: 8.7.12 or higher for versions 8.0.0 to 8.7.11, and 8.8.2 or higher for versions 8.8.0 to 8.8.1.
Yes, a temporary workaround is to disable the install.php page by removing or renaming the install.php file in the Drupal core installation directory. However, this should only be considered as a temporary measure until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
