Vulnerability Description
A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the <siteroot>/vendor/phpunit directory from your production deployments
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Drupal | Drupal | 8.0.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/96919Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1038058
- https://www.drupal.org/SA-2017-001MitigationVendor Advisory
- http://www.securityfocus.com/bid/96919Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1038058
- https://www.drupal.org/SA-2017-001MitigationVendor Advisory
FAQ
What is CVE-2017-6381?
CVE-2017-6381 is a vulnerability with a CVSS score of 8.1 (HIGH). A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, an...
How severe is CVE-2017-6381?
CVE-2017-6381 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-6381?
Check the references section above for vendor advisories and patch information. Affected products include: Drupal Drupal.