CVE-2017-6381GHSA-RHX9-3QF7-R3J7
A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 8.2.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the <siteroot>/vendor/phpunit directory from your production deployments
Timeline
- CVE published
- Record last updated
Affected versions
- Drupal Drupal Core
8.2.x versions before 8.2.7
- drupal/corePackagist
From 8.0 · fixed in 8.2.7
- drupal/drupalPackagist
From 8.0 · fixed in 8.2.7