Skip to content
Fencer Vulns
high 8.1

CVE-2019-6340 kev in the critical feed json

Drupal core - Highly critical - Remote Code Execution

published 2019-02-20 7 y ago modified 2026-09-19 50 d ago also DRUPAL-CORE-2019-003 , GHSA-3gx6-h57h-rm27 , EUVD-2022-2184

cvss
8.1
version 3.1, CNA
cisa kev
Exploited
added 2022-03-25
epss
92.0%
EPSS 92.0% chance of exploitation in 30 days, percentile 99.8%
public exploits
4
Metasploit, Exploit-DB, plus a Nuclei check

Summary

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

Patch / fix

cisa required action Apply updates per vendor instructions.

  • packagist drupal/core 7.62.0, 8.5.11, 8.6.10
  • packagist drupal/drupal 7.62.0, 8.5.11, 8.6.10
  • Drupal Drupal Core 8.5.11, 8.6.10

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-6340 updated cvss 9.8

drupal: does not sanitize data from non-form sources leads to arbitrary PHP code execution

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/unix/webapp/drupal_restws_unserialize)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
4 y ago
Patch by
2022-04-15 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
Drupal, Core
CISA name
Drupal Core Remote Code Execution Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction

92.02% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub 3.0 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

Affected packages

ecosystem package affected fixed in
packagist drupal/core
>=8.6.0, <8.6.10
>=7.0.0, <7.62.0
>=8.0.0, <8.5.11
8.6.10
7.62.0
8.5.11
packagist drupal/drupal
>=7.0.0, <7.62.0
>=8.0.0, <8.5.11
>=8.6.0, <8.6.10
7.62.0
8.5.11
8.6.10

Affected products

  • Drupal Drupal Core

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.