CVE-2019-6340: Drupal Core Remote Code Execution Vulnerability

Vulnerability summary

CVE-2019-6340 is a high (CVSS 8.1) Deserialization of Untrusted Data vulnerability in Drupal Core. It is known to be exploited: CISA lists it, first on 25-03-2022. EPSS estimates a 92.02% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 4 public exploits are recorded.

Timeline

1. 21-02-2019
   PublishedVulnerability first disclosed.
2. 25-03-2022
   Added to CISA KEVDrupal Core Remote Code Execution Vulnerability
3. 15-04-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.