CISA KEV · Known exploitedHigh

CVE-2019-6340

Drupal Core

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you...

CVSS: 8.1
EPSS: 92.0%
CISA KEV: Listed
Published: 2019.02.22

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability92.0%

Technical severityCVSS 8.1

Vulnerability overview

Affected product and versions

Product: Drupal Core
Affected versions: 8.5, 8.6, >= 8.5.0 < 8.5.11, >= 8.6.0 < 8.6.10
Fixed versions: 8.5.11, 8.6.10

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2022.04.15

1
Identify
Confirm that Drupal Core and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-502
KEV added: 2022.03.25
Ransomware use: 미확인