Severity
- CVSS 3.x
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/drupal/drupal ↗ | |
| 35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before a795651d0b60a8a5d4867223fbc10bcbdfb5ee87 | a795651d0b60a8a5d4867223fbc10bcbdfb5ee87 |
Also listed as affected (9)
| |
Description
Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.