CVE-2019-6340: Drupal Core Remote Code Execution Vulnerability
Highly critical - Remote Code Execution
Other sources
In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.
— CISA
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 8.6.10 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 8.5.11 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 7.62.0 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.5.11 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 7.62.0 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 8.6.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.6.10 - Compensating control
If Services (Drupal 7) or Drupal 8 RESTful Web Services (rest) / other web services modules (e.g., JSON:API) are enabled, restrict PATCH or POST requests to limit exposure to the Remote Code Execution vulnerability.
Event History
Frequently Asked Questions
What is the severity of CVE-2019-6340?
CVE-2019-6340 is classified as highly critical due to its potential for remote code execution.
How do I fix CVE-2019-6340?
To remediate CVE-2019-6340, update Drupal to version 7.62.0, 8.5.11, or 8.6.10 or later.
What versions of Drupal are affected by CVE-2019-6340?
CVE-2019-6340 affects Drupal versions from 7.0.0 to 7.62.0, and 8.0.0 to 8.6.10.
What kind of vulnerability is CVE-2019-6340?
CVE-2019-6340 is a remote code execution vulnerability that allows arbitrary PHP code execution in certain cases.
Is CVE-2019-6340 related to data sanitization issues?
Yes, CVE-2019-6340 arises from field types in Drupal that do not properly sanitize data from non-form sources.