Vulnerability advisory

CVE-2017-6381

Published Mar 16, 2017Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
35c2f3ca5c935f3d8bde15932a712677c9bbd50f through 6ffaabfece5d21e41c1ae53c8e3a8f6ffa94582a	No fix listed
Also listed as affected (48) `8.0.0` `8.0.0-alpha14` `8.0.0-alpha15` `8.0.0-beta1` `8.0.0-beta10` `8.0.0-beta11` `8.0.0-beta12` `8.0.0-beta13` `8.0.0-beta14` `8.0.0-beta15` `8.0.0-beta16` `8.0.0-beta2` `8.0.0-beta3` `8.0.0-beta4` `8.0.0-beta6` `8.0.0-beta7` `8.0.0-beta9` `8.0.0-rc1` `8.0.0-rc2` `8.0.0-rc3` `8.0.0-rc4` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.10` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9` `8.2.0` `8.2.0-beta1` `8.2.0-beta2` `8.2.0-beta3` `8.2.0-rc1` `8.2.0-rc2` `8.2.1`

Description

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the <siteroot>/vendor/phpunit directory from your production deployments

References

Webwww.securitytracker.com/id/1038058 ↗
Advisorywww.securityfocus.com/bid/96919 ↗
Advisorywww.drupal.org/SA-2017-001 ↗