Security News > 2021 > January > Drupal releases fix for critical vulnerability with known exploits
Drupal has released a security update to address a critical vulnerability in a third-party library with documented or deployed exploits available in the wild.
"The Drupal project uses the pear Archive Tar library, which has released a security update that impacts Drupal," the Drupal security team said.
Exploiting the Drupal vulnerability is only possible if the CMS is configured to allow and process.
This vulnerability is related to another critical security flaw with known exploits caused by the CVE-2020-28948 bug in the PEAR Archive Tar library that could allow for arbitrary PHP code execution on some CMS versions.
Drupal issued an out-of-band emergency security update to fix it in November allowing admins to quickly patch their servers to defend them against potential attacks.
Drupal patched another critical remote code execution vulnerability tracked as CVE-2020-13671 and allowing attackers to execute malicious code on vulnerable servers due to improper filenames sanitization for uploaded files.
News URL
Related news
- PoC exploit for critical Fortra FileCatalyst MFT vulnerability released (CVE-2024-25153) (source)
- Exploit available for new critical TeamCity auth bypass bug, patch now (source)
- Proof-of-Concept Exploit Released for Progress Software OpenEdge Vulnerability (source)
- Critical FortiClient EMS vulnerability fixed, (fake?) PoC for sale (CVE-2023-48788) (source)
- Fortra Patches Critical RCE Vulnerability in FileCatalyst Transfer Tool (source)
- Ivanti Releases Urgent Fix for Critical Sentry RCE Vulnerability (source)
- Critical Unpatched Ray AI Platform Vulnerability Exploited for Cryptocurrency Mining (source)
- Critical 'BatBadBut' Rust Vulnerability Exposes Windows Systems to Attacks (source)
- Fortinet Rolls Out Critical Security Patches for FortiClientLinux Vulnerability (source)
- A critical vulnerability in Delinea Secret Server allows auth bypass, admin access (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-11-20 | CVE-2020-13671 | Unrestricted Upload of File with Dangerous Type vulnerability in multiple products Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. | 8.8 |
| 2020-11-19 | CVE-2020-28948 | Deserialization of Untrusted Data vulnerability in multiple products Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. | 7.8 |