CVE-2017-6381 json
Drupal Remote code execution
published 2017-03-16 9 y ago modified 2026-06-17 4 mo ago also GHSA-rhx9-3qf7-r3j7 , EUVD-2022-5180
- cvss
- 8.1
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.9%
- EPSS 3.9% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known
Summary
A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the <siteroot>/vendor/phpunit directory from your production deployments
Patch / fix
- packagist drupal/core 8.2.7
- packagist drupal/drupal 8.2.7
Exploit prediction
3.90% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | drupal/core | >=8.0, <8.2.7 |
8.2.7 |
| packagist | drupal/drupal | >=8.0, <8.2.7 |
8.2.7 |
Affected products
- Drupal Drupal Core
Classification
- Weakness
-
- CWE-829 Inclusion of Functionality from Untrusted Control Sphere
References
-
drupal.org
/SA-2017-001
web, mitigation, vendor-advisory
-
securitytracker.com
/id/1038058
vdb-entry, web
-
securityfocus.com
/bid/96919
vdb-entry, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2017-6381
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6381.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6381.yaml
web
-
github.com
/drupal/core
package
Sources
- CVE List CVE-2017-6381
- GitHub Advisory GHSA-rhx9-3qf7-r3j7
- NVD CVE-2017-6381
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.