CVEs / CVE-2019-6340
CVE-2019-6340: Drupal Core Remote Code Execution Vulnerability
- Known exploited in the CISA KEV catalog since 25 Mar 2022
- high 8.1 CVSS 3.1 (NVD)
- EPSS 92% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2019-6340
Summary
In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.
Description
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Drupal Drupal Core | from 8.5, before 8.5.11 | 8.5.11 |
| Drupal Drupal Core | from 8.6, before 8.6.10 | 8.6.10 |
| Product | Affected | Fixed in |
|---|---|---|
| drupal/core (Packagist) | from 8.6.0, before 8.6.10 | 8.6.10 |
| drupal/core (Packagist) | from 7.0.0, before 7.62.0 | 7.62.0 |
| drupal/core (Packagist) | from 8.0.0, before 8.5.11 | 8.5.11 |
| drupal/drupal (Packagist) | from 7.0.0, before 7.62.0 | 7.62.0 |
| drupal/drupal (Packagist) | from 8.0.0, before 8.5.11 | 8.5.11 |
| drupal/drupal (Packagist) | from 8.6.0, before 8.6.10 | 8.6.10 |
Package versions from GHSA-3gx6-h57h-rm27.
Exploitation
| In CISA KEV since | 25 Mar 2022 |
|---|---|
| Due date for US federal agencies | 15 Apr 2022 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply updates per vendor instructions. |
Severity
| CVSS 3.1 | 8.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HScored by NVD |
|---|---|
| Weakness | CWE-502 |
References
- CVE-2019-6340 on NVD
- CVE-2019-6340 in the CISA KEV catalog
- CVE-2019-6340 on OSV
- http://www.securityfocus.com/bid/107106 Broken Link, Third Party Advisory, VDB Entry
- https://www.drupal.org/sa-core-2019-003 Mitigation, Vendor Advisory
- https://www.exploit-db.com/exploits/46452/ Patch, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/46459/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/46510/ Exploit, Third Party Advisory
- https://www.synology.com/security/advisory/Synology_SA_19_09 Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.