Background exploitation KEV catalog No authentication

CVE-2019-6340

Drupal Core Remote Code Execution Vulnerability

CheckOps priority index

8.4/10 Patch within 24 h

Severity8.1

Probability9.2

Exploitation4/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 92.0% higher than 99.8% of CVEs

CVSS 3.1 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:

Exploited for 1,684 days 25 Mar 2022

CISA due date 15 Apr 2022 for US federal agencies

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 4 / 5

KEV catalog (CISA)25 Mar 2022
Exploited in EUVD (ENISA)25 Mar 2022
Used by ransomwareno
EPSS above 10 %92.0%
No account, over the networkyes

What to do

Fix

Apply the vendor’s fix as soon as it is available.

CISA guidance: Apply updates per vendor instructions.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

Affected products

drupal coreCore

Affected versions

8.5 <8.5.11
8.6 <8.6.10

Weaknesses (CWE)

CWE-502

Open source packages OSV

Affected libraries according to OSV, with fixed versions.

Timeline

21 Feb 2019
Published
25 Mar 2022
Exploitation reported (ENISA)
25 Mar 2022
Added to the KEV catalog
15 Apr 2022
CISA remediation due date
26 Sept 2026
EPSS peak: 92.0%

References

Other exploited vulnerabilities from the same vendor

CVE-2026-9082Drupal Core SQL Injection Vulnerability
9.0 · Actively exploited
CVE-2018-7602Drupal Core Remote Code Execution Vulnerability
9.2 · Background exploitation
CVE-2020-13671Drupal core Un-restricted Upload of File
6.4 · Background exploitation
CVE-2018-7600Drupal Core Remote Code Execution Vulnerability
9.9 · Background exploitation