CVE-2019-6340

🗓️ 21 Feb 2019 21:00:00Reported by Debian Security Bug TrackerType

debiancve🔗 security-tracker.debian.org👁 37 Views

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases

Reporter	Title	Published	Views	Family All 67
FreeBSD	drupal -- Drupal core - Highly critical - Remote Code Execution	20 Feb 201900:00	–	freebsd
GithubExploit	Exploit for Deserialization of Untrusted Data in Drupal	27 May 202601:16	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Drupal	31 Aug 202022:55	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Drupal	25 Feb 201907:47	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Drupal	1 May 202115:00	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Drupal	25 Feb 201903:38	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Drupal	27 May 201919:06	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Drupal	22 Feb 201916:03	–	githubexploit
0day.today	Drupal < 8.6.10 / < 8.5.11 - REST Module Remote Code Execution Vulnerability	24 Feb 201900:00	–	zdt
0day.today	Drupal < 8.6.9 - REST Module Remote Code Execution Exploit	25 Feb 201900:00	–	zdt

21 Feb 2019 21:00Current

8.4High risk

Vulners AI Score8.4

CVSS 26.8

CVSS 3.18.1

EPSS0.92017

SSVC