Security News > 2020 > November > Remote Code Execution Vulnerability Patched in Drupal

Remote Code Execution Vulnerability Patched in Drupal
2020-11-19 13:23

Updates released on Wednesday for the Drupal content management system patch a remote code execution vulnerability related to failure to properly sanitize the names of uploaded files.

The vulnerability, tracked as CVE-2020-13671, has been classified as critical, but it's worth mentioning that Drupal uses the NIST Common Misuse Scoring System, which assigns vulnerabilities a score ranging between 0 and 25, with "Critical" being only the second highest rating, after "Highly critical."

"Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations," Drupal explained in an advisory.

The issue was reported to Drupal developers by several people, and it has been patched in Drupal 7, 8 and 9 with the release of versions 7.74, 8.8.11, 8.9.9 and 9.0.8.

In March they updated the CKEditor to patch XSS vulnerabilities, in May they addressed XSS and open redirect flaws, in June they fixed code execution and several other types of issues, and in September they patched XSS and information disclosure vulnerabilities.


News URL

http://feedproxy.google.com/~r/Securityweek/~3/H15fttAEWLw/remote-code-execution-vulnerability-patched-drupal

Related Vulnerability

DATE CVE VULNERABILITY TITLE RISK
2020-11-20 CVE-2020-13671 Unrestricted Upload of File with Dangerous Type vulnerability in multiple products
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations.
network
low complexity
drupal fedoraproject CWE-434
8.8

Related vendor

VENDOR LAST 12M #/PRODUCTS LOW MEDIUM HIGH CRITICAL TOTAL VULNS
Drupal 135 209 504 90 16 819