Drupal core Denial of Service in drupal/drupal
Summary
GHSA-w333-5f96-mjrr: Drupal core Denial of Service. Affects drupal/drupal across 2 version ranges.
>= 8.0.0, < 8.7.11
>= 8.8.0, < 8.8.1
Fixed in 8.7.11 or 8.8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications. The vulnerability in the Drupal core affects versions 8.0.0 to 8.7.11 and 8.8.0 to 8.8.1. This vulnerability can lead to a Denial of Service (DoS) attack, where a visit to install.php can corrupt cached data, impairing the site until caches are rebuilt.
Vulnerability Detail
The vulnerability in Drupal core arises from a flaw in the handling of cached data during the installation process. When a user visits install.php, it triggers a corruption of cached data, which can cause the site to become impaired until the caches are rebuilt. This vulnerability can be exploited by an attacker to disrupt the normal functioning of a Drupal site, potentially leading to service unavailability and loss of data. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.118.7.11composer require drupal/drupal:8.7.11 -
>= 8.8.0, < 8.8.18.8.1composer require drupal/drupal:8.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to apply the available patches or upgrade to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The Drupal core Denial of Service vulnerability can lead to a disruption of normal site functioning and potential loss of data. It is crucial for Drupal site administrators to apply the necessary patches or upgrade to the fixed versions to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for drupal/drupal →
FAQ
Drupal is an open-source content management system (CMS) written in PHP. It provides a flexible platform for building websites and applications.
A Denial of Service (DoS) attack is a malicious attempt to disrupt the normal functioning of a network, system, or application, making it unavailable to its intended users.
This vulnerability can be exploited by visiting the install.php page of a vulnerable Drupal site, causing cached data corruption and impairing the site until caches are rebuilt.
The potential consequences of this vulnerability include service unavailability, loss of data, and disruption of normal site functionality.
To fix this vulnerability, Drupal site administrators should update their installations to the fixed versions mentioned in the 'how_to_fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/drupal.
