Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login.
Contenu original affiche; la traduction localisee n'est pas encore disponible.
Ce qui s'est passé
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login.
Pourquoi c'est important
The incident may affect operational continuity, asset safety or trust around Security. Watch for verified scope and remediation.
Entités concernées
Voir les preuves
1 articles · 1 publication d'origine · 1 independantes
- The Hacker NewsSource primaire · Confirme · EN · 100%Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules ↗
Affirmations
- Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules Observé
Divergences
Aucune divergence importante détectée dans les preuves disponibles.
Chronologie
- Premier signalement
- Non vérifié · 80/65%
Mouvement de marché suivant l'événement
La réaction du marché n'est pas encore disponible pour cet actif et cette fenêtre.