Millions of websites threatened by highly critical code-execution bug in Drupal

'Millions of sites that run the Drupal content management system run
the risk of being hijacked until they're patched against a
vulnerability that allows hackers to remotely execute malicious code,
managers of the open source project warned Wednesday.

CVE-2019-6340, as the flaw is tracked, stems from a failure to
sufficiently validate user input, managers said in an advisory.
Hackers who exploited the vulnerability could, in some cases, run code
of their choice on vulnerable websites. The flaw is rated highly
critical.

"Some field types do not properly sanitize data from non-form
sources," the advisory stated. "This can lead to arbitrary PHP code
execution in some cases."'

-- source: https://arstechnica.com/information-technology/2019/02/millions-of-websites-threatened-by-highly-critical-code-execution-bug-in-drupal/

Cheers, Peter
-- 
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
_______________________________________________
wlug mailing list | [email protected]
Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug