Security News > 2020 > June > Drupal Patches Code Execution Flaw Most Likely to Impact Windows Servers

Updates released this week by Drupal patch several vulnerabilities, including a flaw that could allow an attacker to execute arbitrary PHP code.

The code execution vulnerability, tracked as CVE-2020-13664, can be exploited against Drupal 8 and 9 installations, but only in certain circumstances.

According to Drupal developers, the issue is most likely to affect Windows servers.

"An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability," reads an advisory published on Wednesday for the flaw.

"The Drupal core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities," Drupal developers explained.

News URL

http://feedproxy.google.com/~r/Securityweek/~3/PCBbq11YIqA/drupal-patches-code-execution-flaw-most-likely-impact-windows-servers