CVE-2022-25277: Malicious File Upload
First published: Wed Jul 20 2022(Updated: )
Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2022-014
Credit: mlhess@drupal.org mlhess@drupal.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/drupal/core | >=8.9.0<8.10.0>=9.0.0<9.1.0>=9.1.0<9.2.0>=9.2.0<9.3.0>=9.3.0<9.3.19>=9.4.0<9.4.3 | |
| Drupal Drupal | >=8.0.0<9.3.19 | |
| Drupal Drupal | >=9.4.0<9.4.3 | |
| composer/drupal/core | >=9.4.0<9.4.3 | 9.4.3 |
| composer/drupal/core | >=8.0.0<9.3.19 | 9.3.19 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.drupal.org/sa-core-2022-014
- https://github.com/drupal/core/commit/1cd1830d79f221cc8490f53c2bb487dd07094f17
- https://github.com/drupal/core/commit/5d464ea4407c50e40dcf6cb5ee376e7b8dd36f3a
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25277.yaml
- https://nvd.nist.gov/vuln/detail/CVE-2022-25277
- https://github.com/advisories/GHSA-6955-67hm-vjjq (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this Drupal vulnerability?
The vulnerability ID for this Drupal vulnerability is CVE-2022-25277.
What is the severity of CVE-2022-25277?
The severity of CVE-2022-25277 is high with a CVSS score of 7.2.
How does CVE-2022-25277 affect Drupal?
CVE-2022-25277 affects Drupal versions 8.9.0 up to 8.10.0, 9.0.0 up to 9.1.0, 9.1.0 up to 9.2.0, 9.2.0 up to 9.3.0, 9.3.0 up to 9.3.19, and 9.4.0 up to 9.4.3.
What does CVE-2022-25277 allow an attacker to do?
CVE-2022-25277 allows an attacker to execute arbitrary PHP code.
How can I fix the vulnerability CVE-2022-25277?
To fix the vulnerability CVE-2022-25277, it is recommended to update Drupal core to a version that includes the patch provided in SA-CORE-2022-014.
- collector/friends-of-php
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-6955-67hm-vjjq
- alias/CVE-2022-25277
- collector/nvd-cve
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/severity
- agent/description
- agent/tags
- agent/event
- agent/trending
- package-manager/composer
- vendor/drupal
- canonical/drupal drupal
- version/drupal drupal/8.0.0
- version/drupal drupal/9.4.0