CVE-2017-6920 — Vulnerability in drupal/drupal — CVE Details
Drupal PECL YAML parser unsafe object handling
Summary
Advisory Timeline
- First published May 14, 2022 (1612 days ago).
- Last revised April 23, 2024 — 711 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
composer require "drupal/drupal:^8.3.4"
composer require "drupal/core:^8.3.4"
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (2)
Affects 1 ecosystem: packagist (2).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| drupal/drupal | packagist | 8.0.0, 8.0.0-alpha14, 8.0.0-alpha15, 8.0.0-beta1 (+60 more) | 8.3.4 |
| drupal/core | packagist | 8.0.0, 8.0.0-beta10, 8.0.0-beta11, 8.0.0-beta12 (+54 more) | 8.3.4 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-94Code InjectionMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-6920ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6920.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6920.yamlWEB
- https://github.com/drupal/corePACKAGE
- https://www.drupal.org/SA-CORE-2017-003WEB
- https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multipleWEB
- https://www.securityfocus.com/bid/99211WEB
- https://www.securitytracker.com/id/1038781WEB
Frequently Asked Questions
- What is CVE-2017-6920?
- Drupal PECL YAML parser unsafe object handling This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2017-6920?
- CVE-2017-6920 affects drupal/drupal and drupal/core. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2017-6920 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2018-7602CRITICAL
Drupal Core Remote Code Execution Vulnerability
- CVE-2018-7600CRITICAL
Drupal Core Remote Code Execution Vulnerability
- CVE-2019-6339CRITICAL
Arbitrary PHP code execution in Drupal
- CVE-2017-6925CRITICAL
Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
- CVE-2020-13671HIGH
Drupal core Unrestricted Upload of File with Dangerous Type
- CVE-2024-55638HIGH
Drupal core contains a potential PHP Object Injection vulnerability
- CVE-2020-13663HIGH
Drupal Core Cross-Site Request Forgery (CSRF) vulnerability
- CVE-2024-55636LOW
Drupal core contains a potential PHP Object Injection vulnerability
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies