cvelistv5 - CVE-2019-6340

CVE-2019-6340 (GCVE-0-2019-6340)

Vulnerability from cvelistv5 – Published: 2019-02-21 21:00 – Updated: 2025-10-21 23:45

CISA

Title

Drupal core - Highly critical - Remote Code Execution

Summary

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Remote code execution

Assigner

drupal

References

URL

Tags

	https://www.synology.com/security/advisory/Synolo…	x_refsource_CONFIRM
	https://www.exploit-db.com/exploits/46452/	exploitx_refsource_EXPLOIT-DB
	https://www.drupal.org/sa-core-2019-003	x_refsource_CONFIRM
	https://www.exploit-db.com/exploits/46510/	exploitx_refsource_EXPLOIT-DB
	http://www.securityfocus.com/bid/107106	vdb-entryx_refsource_BID
	https://www.exploit-db.com/exploits/46459/	exploitx_refsource_EXPLOIT-DB

Impacted products

	Vendor	Product	Version
	Drupal	Drupal Core	Affected: 8.5 , < 8.5.11 (custom) Affected: 8.6 , < 8.6.10 (custom)

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

Date added: 2022-03-25

Due date: 2022-04-15

Required action: Apply updates per vendor instructions.

Used in ransomware: Unknown

Notes: https://nvd.nist.gov/vuln/detail/CVE-2019-6340

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:16:24.806Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.synology.com/security/advisory/Synology_SA_19_09"
          },
          {
            "name": "46452",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/46452/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.drupal.org/sa-core-2019-003"
          },
          {
            "name": "46510",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/46510/"
          },
          {
            "name": "107106",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/107106"
          },
          {
            "name": "46459",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/46459/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2019-6340",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-07T12:38:47.444954Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-03-25",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-502",
                "description": "CWE-502 Deserialization of Untrusted Data",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:45:43.200Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2022-03-25T00:00:00+00:00",
            "value": "CVE-2019-6340 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Drupal Core",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "8.5.11",
              "status": "affected",
              "version": "8.5",
              "versionType": "custom"
            },
            {
              "lessThan": "8.6.10",
              "status": "affected",
              "version": "8.6",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2019-02-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote code execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-03-08T10:57:01.000Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.synology.com/security/advisory/Synology_SA_19_09"
        },
        {
          "name": "46452",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/46452/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.drupal.org/sa-core-2019-003"
        },
        {
          "name": "46510",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/46510/"
        },
        {
          "name": "107106",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/107106"
        },
        {
          "name": "46459",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/46459/"
        }
      ],
      "source": {
        "advisory": "SA-CORE-2019-003",
        "discovery": "UNKNOWN"
      },
      "title": "Drupal core - Highly critical - Remote Code Execution",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@drupal.org",
          "ID": "CVE-2019-6340",
          "STATE": "PUBLIC",
          "TITLE": "Drupal core - Highly critical - Remote Code Execution"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Drupal Core",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_name": "8.5",
                            "version_value": "8.5.11"
                          },
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_name": "8.6",
                            "version_value": "8.6.10"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Drupal"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote code execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.synology.com/security/advisory/Synology_SA_19_09",
              "refsource": "CONFIRM",
              "url": "https://www.synology.com/security/advisory/Synology_SA_19_09"
            },
            {
              "name": "46452",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/46452/"
            },
            {
              "name": "https://www.drupal.org/sa-core-2019-003",
              "refsource": "CONFIRM",
              "url": "https://www.drupal.org/sa-core-2019-003"
            },
            {
              "name": "46510",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/46510/"
            },
            {
              "name": "107106",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/107106"
            },
            {
              "name": "46459",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/46459/"
            }
          ]
        },
        "source": {
          "advisory": "SA-CORE-2019-003",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2019-6340",
    "datePublished": "2019-02-21T21:00:00.000Z",
    "dateReserved": "2019-01-15T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:45:43.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2019-6340",
      "cwes": "[\"CWE-502\"]",
      "dateAdded": "2022-03-25",
      "dueDate": "2022-04-15",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://nvd.nist.gov/vuln/detail/CVE-2019-6340",
      "product": "Core",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.",
      "vendorProject": "Drupal",
      "vulnerabilityName": "Drupal Core Remote Code Execution Vulnerability"
    },
    "fkie_nvd": {
      "cisaActionDue": "2022-04-15",
      "cisaExploitAdd": "2022-03-25",
      "cisaRequiredAction": "Apply updates per vendor instructions.",
      "cisaVulnerabilityName": "Drupal Core Remote Code Execution Vulnerability",
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.5.0\", \"versionEndExcluding\": \"8.5.11\", \"matchCriteriaId\": \"C48137EC-482F-4A58-8C07-FCC401416C94\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.6.0\", \"versionEndExcluding\": \"8.6.10\", \"matchCriteriaId\": \"78790D50-3793-41B4-9490-78EDF9A1C4B4\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)\"}, {\"lang\": \"es\", \"value\": \"Algunos tipos de campos no sanean correctamente los datos provenientes de fuentes \\\"non-form\\\" en Drupal en sus versiones 8.5.x anteriores a la 8.5.11 y en las versiones 8.6.x anteriores a la 8.6.10. Esto puede provocar, en algunos casos, la ejecuci\\u00f3n de c\\u00f3digo PHP. Un sitio solo se ve afectado por esto si se cumple una de las siguientes condiciones. Este sitio tiene el m\\u00f3dulo Drupal 8 core RESTful Web Services (rest) habilitado y permite peticiones PATCH o POST, o el sitio tiene otro m\\u00f3dulo de servicios web habilitado, como JSON:API en Drupal 8 o Services o RESTful Web Services en Drupal 7. (Nota: El m\\u00f3dulo de Drupal 7 Services mismo no precisa una actualizaci\\u00f3n en este momento. Sin embargo, se deber\\u00edan instalar otras actualizaciones contribuidas que est\\u00e9n asociadas con este aviso si \\\"Service\\\" se encuentra en uso.)\"}]",
      "id": "CVE-2019-6340",
      "lastModified": "2024-11-21T04:46:26.593",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2019-02-21T21:29:00.343",
      "references": "[{\"url\": \"http://www.securityfocus.com/bid/107106\", \"source\": \"mlhess@drupal.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://www.drupal.org/sa-core-2019-003\", \"source\": \"mlhess@drupal.org\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}, {\"url\": \"https://www.exploit-db.com/exploits/46452/\", \"source\": \"mlhess@drupal.org\", \"tags\": [\"Patch\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://www.exploit-db.com/exploits/46459/\", \"source\": \"mlhess@drupal.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://www.exploit-db.com/exploits/46510/\", \"source\": \"mlhess@drupal.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.synology.com/security/advisory/Synology_SA_19_09\", \"source\": \"mlhess@drupal.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/107106\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://www.drupal.org/sa-core-2019-003\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}, {\"url\": \"https://www.exploit-db.com/exploits/46452/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://www.exploit-db.com/exploits/46459/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://www.exploit-db.com/exploits/46510/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.synology.com/security/advisory/Synology_SA_19_09\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "mlhess@drupal.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-502\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-6340\",\"sourceIdentifier\":\"mlhess@drupal.org\",\"published\":\"2019-02-21T21:29:00.343\",\"lastModified\":\"2025-11-07T19:36:49.270\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)\"},{\"lang\":\"es\",\"value\":\"Algunos tipos de campos no sanean correctamente los datos provenientes de fuentes \\\"non-form\\\" en Drupal en sus versiones 8.5.x anteriores a la 8.5.11 y en las versiones 8.6.x anteriores a la 8.6.10. Esto puede provocar, en algunos casos, la ejecuci\u00f3n de c\u00f3digo PHP. Un sitio solo se ve afectado por esto si se cumple una de las siguientes condiciones. Este sitio tiene el m\u00f3dulo Drupal 8 core RESTful Web Services (rest) habilitado y permite peticiones PATCH o POST, o el sitio tiene otro m\u00f3dulo de servicios web habilitado, como JSON:API en Drupal 8 o Services o RESTful Web Services en Drupal 7. (Nota: El m\u00f3dulo de Drupal 7 Services mismo no precisa una actualizaci\u00f3n en este momento. Sin embargo, se deber\u00edan instalar otras actualizaciones contribuidas que est\u00e9n asociadas con este aviso si \\\"Service\\\" se encuentra en uso.)\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"cisaExploitAdd\":\"2022-03-25\",\"cisaActionDue\":\"2022-04-15\",\"cisaRequiredAction\":\"Apply updates per vendor instructions.\",\"cisaVulnerabilityName\":\"Drupal Core Remote Code Execution Vulnerability\",\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.5.0\",\"versionEndExcluding\":\"8.5.11\",\"matchCriteriaId\":\"C48137EC-482F-4A58-8C07-FCC401416C94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.6.0\",\"versionEndExcluding\":\"8.6.10\",\"matchCriteriaId\":\"78790D50-3793-41B4-9490-78EDF9A1C4B4\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/107106\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\",\"Broken Link\"]},{\"url\":\"https://www.drupal.org/sa-core-2019-003\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://www.exploit-db.com/exploits/46452/\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Patch\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.exploit-db.com/exploits/46459/\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.exploit-db.com/exploits/46510/\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.synology.com/security/advisory/Synology_SA_19_09\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/107106\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\",\"Broken Link\"]},{\"url\":\"https://www.drupal.org/sa-core-2019-003\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://www.exploit-db.com/exploits/46452/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.exploit-db.com/exploits/46459/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.exploit-db.com/exploits/46510/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.synology.com/security/advisory/Synology_SA_19_09\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.synology.com/security/advisory/Synology_SA_19_09\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://www.exploit-db.com/exploits/46452/\", \"name\": \"46452\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"]}, {\"url\": \"https://www.drupal.org/sa-core-2019-003\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://www.exploit-db.com/exploits/46510/\", \"name\": \"46510\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"]}, {\"url\": \"http://www.securityfocus.com/bid/107106\", \"name\": \"107106\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\", \"x_transferred\"]}, {\"url\": \"https://www.exploit-db.com/exploits/46459/\", \"name\": \"46459\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-04T20:16:24.806Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2019-6340\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-07T12:38:47.444954Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2022-03-25\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340\"}}}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2022-03-25T00:00:00+00:00\", \"value\": \"CVE-2019-6340 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340\", \"tags\": [\"government-resource\"]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"CWE-502 Deserialization of Untrusted Data\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-07T12:37:30.562Z\"}}], \"cna\": {\"title\": \"Drupal core - Highly critical - Remote Code Execution\", \"source\": {\"advisory\": \"SA-CORE-2019-003\", \"discovery\": \"UNKNOWN\"}, \"affected\": [{\"vendor\": \"Drupal\", \"product\": \"Drupal Core\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.5\", \"lessThan\": \"8.5.11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"8.6\", \"lessThan\": \"8.6.10\", \"versionType\": \"custom\"}]}], \"datePublic\": \"2019-02-21T00:00:00.000Z\", \"references\": [{\"url\": \"https://www.synology.com/security/advisory/Synology_SA_19_09\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://www.exploit-db.com/exploits/46452/\", \"name\": \"46452\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"]}, {\"url\": \"https://www.drupal.org/sa-core-2019-003\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://www.exploit-db.com/exploits/46510/\", \"name\": \"46510\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"]}, {\"url\": \"http://www.securityfocus.com/bid/107106\", \"name\": \"107106\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\"]}, {\"url\": \"https://www.exploit-db.com/exploits/46459/\", \"name\": \"46459\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"Remote code execution\"}]}], \"providerMetadata\": {\"orgId\": \"2c85b837-eb8b-40ed-9d74-228c62987387\", \"shortName\": \"drupal\", \"dateUpdated\": \"2019-03-08T10:57:01.000Z\"}, \"x_legacyV4Record\": {\"source\": {\"advisory\": \"SA-CORE-2019-003\", \"discovery\": \"UNKNOWN\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"affected\": \"\u003c\", \"version_name\": \"8.5\", \"version_value\": \"8.5.11\", \"version_affected\": \"\u003c\"}, {\"affected\": \"\u003c\", \"version_name\": \"8.6\", \"version_value\": \"8.6.10\", \"version_affected\": \"\u003c\"}]}, \"product_name\": \"Drupal Core\"}]}, \"vendor_name\": \"Drupal\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://www.synology.com/security/advisory/Synology_SA_19_09\", \"name\": \"https://www.synology.com/security/advisory/Synology_SA_19_09\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://www.exploit-db.com/exploits/46452/\", \"name\": \"46452\", \"refsource\": \"EXPLOIT-DB\"}, {\"url\": \"https://www.drupal.org/sa-core-2019-003\", \"name\": \"https://www.drupal.org/sa-core-2019-003\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://www.exploit-db.com/exploits/46510/\", \"name\": \"46510\", \"refsource\": \"EXPLOIT-DB\"}, {\"url\": \"http://www.securityfocus.com/bid/107106\", \"name\": \"107106\", \"refsource\": \"BID\"}, {\"url\": \"https://www.exploit-db.com/exploits/46459/\", \"name\": \"46459\", \"refsource\": \"EXPLOIT-DB\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"Remote code execution\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2019-6340\", \"STATE\": \"PUBLIC\", \"TITLE\": \"Drupal core - Highly critical - Remote Code Execution\", \"ASSIGNER\": \"security@drupal.org\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2019-6340\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-21T23:45:43.200Z\", \"dateReserved\": \"2019-01-15T00:00:00.000Z\", \"assignerOrgId\": \"2c85b837-eb8b-40ed-9d74-228c62987387\", \"datePublished\": \"2019-02-21T21:00:00.000Z\", \"assignerShortName\": \"drupal\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2019-6340

Vulnerability from fkie_nvd - Published: 2019-02-21 21:29 - Updated: 2025-11-07 19:36

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
mlhess@drupal.org	http://www.securityfocus.com/bid/107106	Broken Link, Third Party Advisory, VDB Entry
mlhess@drupal.org	https://www.drupal.org/sa-core-2019-003	Mitigation, Vendor Advisory
mlhess@drupal.org	https://www.exploit-db.com/exploits/46452/	Patch, Third Party Advisory, VDB Entry
mlhess@drupal.org	https://www.exploit-db.com/exploits/46459/	Exploit, Third Party Advisory, VDB Entry
mlhess@drupal.org	https://www.exploit-db.com/exploits/46510/	Exploit, Third Party Advisory
mlhess@drupal.org	https://www.synology.com/security/advisory/Synology_SA_19_09	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/107106	Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://www.drupal.org/sa-core-2019-003	Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.exploit-db.com/exploits/46452/	Patch, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://www.exploit-db.com/exploits/46459/	Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://www.exploit-db.com/exploits/46510/	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.synology.com/security/advisory/Synology_SA_19_09	Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340	US Government Resource

Impacted products

	Vendor	Product	Version
	drupal	drupal	*
	drupal	drupal	*

JSON

To clipboard

{
  "cisaActionDue": "2022-04-15",
  "cisaExploitAdd": "2022-03-25",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Drupal Core Remote Code Execution Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C48137EC-482F-4A58-8C07-FCC401416C94",
              "versionEndExcluding": "8.5.11",
              "versionStartIncluding": "8.5.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "78790D50-3793-41B4-9490-78EDF9A1C4B4",
              "versionEndExcluding": "8.6.10",
              "versionStartIncluding": "8.6.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)"
    },
    {
      "lang": "es",
      "value": "Algunos tipos de campos no sanean correctamente los datos provenientes de fuentes \"non-form\" en Drupal en sus versiones 8.5.x anteriores a la 8.5.11 y en las versiones 8.6.x anteriores a la 8.6.10. Esto puede provocar, en algunos casos, la ejecuci\u00f3n de c\u00f3digo PHP. Un sitio solo se ve afectado por esto si se cumple una de las siguientes condiciones. Este sitio tiene el m\u00f3dulo Drupal 8 core RESTful Web Services (rest) habilitado y permite peticiones PATCH o POST, o el sitio tiene otro m\u00f3dulo de servicios web habilitado, como JSON:API en Drupal 8 o Services o RESTful Web Services en Drupal 7. (Nota: El m\u00f3dulo de Drupal 7 Services mismo no precisa una actualizaci\u00f3n en este momento. Sin embargo, se deber\u00edan instalar otras actualizaciones contribuidas que est\u00e9n asociadas con este aviso si \"Service\" se encuentra en uso.)"
    }
  ],
  "id": "CVE-2019-6340",
  "lastModified": "2025-11-07T19:36:49.270",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2019-02-21T21:29:00.343",
  "references": [
    {
      "source": "mlhess@drupal.org",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/107106"
    },
    {
      "source": "mlhess@drupal.org",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://www.drupal.org/sa-core-2019-003"
    },
    {
      "source": "mlhess@drupal.org",
      "tags": [
        "Patch",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.exploit-db.com/exploits/46452/"
    },
    {
      "source": "mlhess@drupal.org",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.exploit-db.com/exploits/46459/"
    },
    {
      "source": "mlhess@drupal.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.exploit-db.com/exploits/46510/"
    },
    {
      "source": "mlhess@drupal.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.synology.com/security/advisory/Synology_SA_19_09"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/107106"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://www.drupal.org/sa-core-2019-003"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.exploit-db.com/exploits/46452/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.exploit-db.com/exploits/46459/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.exploit-db.com/exploits/46510/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.synology.com/security/advisory/Synology_SA_19_09"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340"
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

CNVD-2019-05262

Vulnerability from cnvd - Published: 2019-02-25

Title

Drupal任意PHP代码执行漏洞（CNVD-2019-05262）

Description

Drupal是一款开源的内容管理平台。 Drupal存在任意PHP代码执行漏洞。该漏洞源于某些字段在通过非表格（non-form resources）类型输入时未能正确过滤，攻击者可利用漏洞导致任意代码执行。

Severity

高

Patch Name

Drupal任意PHP代码执行漏洞（CNVD-2019-05262）的补丁

Patch Description

Drupal是一款开源的内容管理平台。 Drupal存在任意PHP代码执行漏洞。该漏洞源于某些字段在通过非表格（non-form resources）类型输入时未能正确过滤，攻击者可利用漏洞导致任意代码执行。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布漏洞修复程序，请及时关注更新： https://www.drupal.org/sa-core-2019-003

Reference

https://nvd.nist.gov/vuln/detail/CVE-2019-6340

Impacted products

Name
['Drupal Drupal 8.5.，<8.5.11', 'Drupal Drupal 8.6.，<8.6.10']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "107106"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-6340"
    }
  },
  "description": "Drupal\u662f\u4e00\u6b3e\u5f00\u6e90\u7684\u5185\u5bb9\u7ba1\u7406\u5e73\u53f0\u3002\n\nDrupal\u5b58\u5728\u4efb\u610fPHP\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u67d0\u4e9b\u5b57\u6bb5\u5728\u901a\u8fc7\u975e\u8868\u683c\uff08non-form resources\uff09\u7c7b\u578b\u8f93\u5165\u65f6\u672a\u80fd\u6b63\u786e\u8fc7\u6ee4\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u5bfc\u81f4\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002",
  "discovererName": "Samuel Mortenson",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.drupal.org/sa-core-2019-003",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-05262",
  "openTime": "2019-02-25",
  "patchDescription": "Drupal\u662f\u4e00\u6b3e\u5f00\u6e90\u7684\u5185\u5bb9\u7ba1\u7406\u5e73\u53f0\u3002\r\n\r\nDrupal\u5b58\u5728\u4efb\u610fPHP\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u67d0\u4e9b\u5b57\u6bb5\u5728\u901a\u8fc7\u975e\u8868\u683c\uff08non-form resources\uff09\u7c7b\u578b\u8f93\u5165\u65f6\u672a\u80fd\u6b63\u786e\u8fc7\u6ee4\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u5bfc\u81f4\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Drupal\u4efb\u610fPHP\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2019-05262\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Drupal Drupal 8.5.*\uff0c\u003c8.5.11",
      "Drupal Drupal 8.6.*\uff0c\u003c8.6.10"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-6340",
  "serverity": "\u9ad8",
  "submitTime": "2019-02-22",
  "title": "Drupal\u4efb\u610fPHP\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2019-05262\uff09"
}

GSD-2019-6340

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2019-6340

Aliases

CVE-2019-6340

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2019-6340",
    "description": "Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)",
    "id": "GSD-2019-6340",
    "references": [
      "https://packetstormsecurity.com/files/cve/CVE-2019-6340"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2019-6340"
      ],
      "details": "Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)",
      "id": "GSD-2019-6340",
      "modified": "2023-12-13T01:23:49.142130Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cisa.gov": {
      "cveID": "CVE-2019-6340",
      "dateAdded": "2022-03-25",
      "dueDate": "2022-04-15",
      "product": "Core",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.",
      "vendorProject": "Drupal",
      "vulnerabilityName": "Drupal Core Remote Code Execution Vulnerability"
    },
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@drupal.org",
        "ID": "CVE-2019-6340",
        "STATE": "PUBLIC",
        "TITLE": "Drupal core - Highly critical - Remote Code Execution"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Drupal Core",
                    "version": {
                      "version_data": [
                        {
                          "affected": "\u003c",
                          "version_name": "8.5",
                          "version_value": "8.5.11"
                        },
                        {
                          "affected": "\u003c",
                          "version_name": "8.6",
                          "version_value": "8.6.10"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Drupal"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Remote code execution"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.synology.com/security/advisory/Synology_SA_19_09",
            "refsource": "CONFIRM",
            "url": "https://www.synology.com/security/advisory/Synology_SA_19_09"
          },
          {
            "name": "46452",
            "refsource": "EXPLOIT-DB",
            "url": "https://www.exploit-db.com/exploits/46452/"
          },
          {
            "name": "https://www.drupal.org/sa-core-2019-003",
            "refsource": "CONFIRM",
            "url": "https://www.drupal.org/sa-core-2019-003"
          },
          {
            "name": "46510",
            "refsource": "EXPLOIT-DB",
            "url": "https://www.exploit-db.com/exploits/46510/"
          },
          {
            "name": "107106",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/107106"
          },
          {
            "name": "46459",
            "refsource": "EXPLOIT-DB",
            "url": "https://www.exploit-db.com/exploits/46459/"
          }
        ]
      },
      "source": {
        "advisory": "SA-CORE-2019-003",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=7.0.0,\u003c7.62.0||\u003e=8.0.0,\u003c8.6.10",
          "affected_versions": "All versions starting from 7.0.0 before 7.62.0, all versions starting from 8.0.0 before 8.6.10",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-502",
            "CWE-937"
          ],
          "date": "2019-03-08",
          "description": "Some field types do not properly sanitize data from non-form sources in Drupal. This can lead to arbitrary PHP code execution in some cases.",
          "fixed_versions": [
            "8.6.10"
          ],
          "identifier": "CVE-2019-6340",
          "identifiers": [
            "CVE-2019-6340"
          ],
          "not_impacted": "All versions before 7.0.0, all versions starting from 7.62.0 before 8.0.0, all versions starting from 8.6.10",
          "package_slug": "packagist/drupal/core",
          "pubdate": "2019-02-21",
          "solution": "Upgrade to version 8.6.10 or above.",
          "title": "Improper Input Validation",
          "urls": [
            "https://www.drupal.org/SA-CORE-2019-003"
          ],
          "uuid": "2b327d30-2c43-40d1-a381-9ce66b369895"
        },
        {
          "affected_range": "\u003e=7.0.0,\u003c7.62.0||\u003e=8.0.0,\u003c8.6.10",
          "affected_versions": "All versions starting from 7.0.0 before 7.62.0, all versions starting from 8.0.0 before 8.6.10",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-502",
            "CWE-937"
          ],
          "date": "2019-03-08",
          "description": "Some field types do not properly sanitize data from non-form sources in Drupal. This can lead to arbitrary PHP code execution in some cases.",
          "fixed_versions": [
            "8.6.10"
          ],
          "identifier": "CVE-2019-6340",
          "identifiers": [
            "CVE-2019-6340"
          ],
          "not_impacted": "All versions before 7.0.0, all versions starting from 7.62.0 before 8.0.0, all versions starting from 8.6.10",
          "package_slug": "packagist/drupal/drupal",
          "pubdate": "2019-02-21",
          "solution": "Upgrade to version 8.6.10 or above.",
          "title": "Improper Input Validation",
          "urls": [
            "https://www.drupal.org/SA-CORE-2019-003"
          ],
          "uuid": "33d80b92-017f-496b-a091-61a44530e0a7"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.6.10",
                "versionStartIncluding": "8.6.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.5.11",
                "versionStartIncluding": "8.5.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@drupal.org",
          "ID": "CVE-2019-6340"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-502"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.drupal.org/sa-core-2019-003",
              "refsource": "CONFIRM",
              "tags": [
                "Mitigation",
                "Vendor Advisory"
              ],
              "url": "https://www.drupal.org/sa-core-2019-003"
            },
            {
              "name": "107106",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/107106"
            },
            {
              "name": "https://www.synology.com/security/advisory/Synology_SA_19_09",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://www.synology.com/security/advisory/Synology_SA_19_09"
            },
            {
              "name": "46459",
              "refsource": "EXPLOIT-DB",
              "tags": [
                "Exploit",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://www.exploit-db.com/exploits/46459/"
            },
            {
              "name": "46452",
              "refsource": "EXPLOIT-DB",
              "tags": [
                "Patch",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://www.exploit-db.com/exploits/46452/"
            },
            {
              "name": "46510",
              "refsource": "EXPLOIT-DB",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://www.exploit-db.com/exploits/46510/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2020-08-24T17:37Z",
      "publishedDate": "2019-02-21T21:29Z"
    }
  }
}

CERTFR-2019-AVI-074

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Drupal. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Drupal	Drupal	Drupal versions 8.6.x antérieures à 8.6.10
	Drupal	Drupal	Drupal versions 8.5.x, ou plus anciennes, antérieures à 8.5.11

References

Title

Publication Time

Tags

Bulletin de sécurité Drupal SA-CORE-2019-003 du 20 février 2019

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Drupal versions 8.6.x ant\u00e9rieures \u00e0 8.6.10",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    },
    {
      "description": "Drupal versions 8.5.x, ou plus anciennes, ant\u00e9rieures \u00e0 8.5.11",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-6340",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6340"
    }
  ],
  "links": [],
  "reference": "CERTFR-2019-AVI-074",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-02-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Drupal. Elle permet \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Drupal",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Drupal SA-CORE-2019-003 du 20 f\u00e9vrier 2019",
      "url": "https://www.drupal.org/sa-core-2019-003"
    }
  ]
}

CERTFR-2019-AVI-074

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans Drupal. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Drupal	Drupal	Drupal versions 8.6.x antérieures à 8.6.10
	Drupal	Drupal	Drupal versions 8.5.x, ou plus anciennes, antérieures à 8.5.11

References

Title

Publication Time

Tags

Bulletin de sécurité Drupal SA-CORE-2019-003 du 20 février 2019

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Drupal versions 8.6.x ant\u00e9rieures \u00e0 8.6.10",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    },
    {
      "description": "Drupal versions 8.5.x, ou plus anciennes, ant\u00e9rieures \u00e0 8.5.11",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-6340",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6340"
    }
  ],
  "links": [],
  "reference": "CERTFR-2019-AVI-074",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-02-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Drupal. Elle permet \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Drupal",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Drupal SA-CORE-2019-003 du 20 f\u00e9vrier 2019",
      "url": "https://www.drupal.org/sa-core-2019-003"
    }
  ]
}

GHSA-3GX6-H57H-RM27

Vulnerability from github – Published: 2022-05-13 01:22 – Updated: 2025-10-22 17:40

Summary

Drupal Core Remote Code Execution Vulnerability

Details

Severity ?

8.1 (High)


                  
                    CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.6.0"
            },
            {
              "fixed": "8.6.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.62.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.5.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/drupal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.62.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/drupal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.5.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/drupal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.6.0"
            },
            {
              "fixed": "8.6.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-6340"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-23T17:19:43Z",
    "nvd_published_at": "2019-02-21T21:29:00Z",
    "severity": "HIGH"
  },
  "details": "Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)",
  "id": "GHSA-3gx6-h57h-rm27",
  "modified": "2025-10-22T17:40:41Z",
  "published": "2022-05-13T01:22:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6340"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6340.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6340.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/drupal/drupal"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-core-2019-003"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/46452"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/46459"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/46510"
    },
    {
      "type": "WEB",
      "url": "https://www.synology.com/security/advisory/Synology_SA_19_09"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Drupal Core Remote Code Execution Vulnerability"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2019-6340 (GCVE-0-2019-6340)

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

FKIE_CVE-2019-6340

CNVD-2019-05262

GSD-2019-6340

CERTFR-2019-AVI-074

Solution

CERTFR-2019-AVI-074

Solution

GHSA-3GX6-H57H-RM27

Tags

Sightings

Nomenclature