Vulnerability Details : CVE-2017-6381

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the <siteroot>/vendor/phpunit directory from your production deployments
Published 2017-03-16 14:59:00
Updated 2019-10-03 00:03:26
Source Drupal.org
View at NVD,   CVE.org
Vulnerability category: File inclusionExecute code

Exploit prediction scoring system (EPSS) score for CVE-2017-6381

EPSS FAQ
6.64%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 93 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-6381

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
6.8
 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P
8.6
6.4
 NIST
8.1
 HIGH CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
2.2
5.9
 NIST

CWE ids for CVE-2017-6381

References for CVE-2017-6381

Products affected by CVE-2017-6381

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close