UpHeron
All vulnerabilities

Servers and applications

CVE-2017-6381

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you…

Severity
High 8.1
Published
16 Mar 2017
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
3.9% in the next 30 daysHigher than 90% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
CWE-829
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Sources
NVD

Description

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the /vendor/phpunit directory from your production deployments

From NVD.

Affected software

SoftwareAffected versions
DrupalServers and applications · cpe:a:drupal:drupal
  • Version 8.2.1
  • Version 8.2.0
  • Version 8.2.0-rc2
  • Version 8.2.0-rc1
All 60 release lines
  • Version 8.0.0-alpha2
  • Version 8.0.0-alpha3
  • Version 8.0.0-alpha4
  • Version 8.0.0-alpha5
  • Version 8.0.0-alpha6
  • Version 8.0.0-alpha7
  • Version 8.0.0-alpha8
  • Version 8.0.0-alpha9
  • Version 8.0.0-alpha10
  • Version 8.0.0-alpha11
  • Version 8.0.0-alpha12
  • Version 8.0.0-alpha13
  • Version 8.0.0-alpha14
  • Version 8.0.0-alpha15
  • Version 8.0.0-beta1
  • Version 8.0.0-beta2
  • Version 8.0.0-beta3
  • Version 8.0.0-beta4
  • Version 8.0.0-beta6
  • Version 8.0.0-beta7
  • Version 8.0.0-beta9
  • Version 8.0.0-beta10
  • Version 8.0.0-beta11
  • Version 8.0.0-beta12
  • Version 8.0.0-beta13
  • Version 8.0.0-beta14
  • Version 8.0.0-beta15
  • Version 8.0.0-beta16
  • Version 8.0.0-rc1
  • Version 8.0.0-rc2
  • Version 8.0.0-rc3
  • Version 8.0.0-rc4
  • Version 8.0.0
  • Version 8.0.1
  • Version 8.0.2
  • Version 8.0.3
  • Version 8.0.4
  • Version 8.0.5
  • Version 8.0.6
  • Version 8.1.0-beta1
  • Version 8.1.0-beta2
  • Version 8.1.0-rc1
  • Version 8.1.0
  • Version 8.1.1
  • Version 8.1.2
  • Version 8.1.3
  • Version 8.1.4
  • Version 8.1.5
  • Version 8.1.6
  • Version 8.1.7
  • Version 8.1.8
  • Version 8.1.9
  • Version 8.1.10
  • Version 8.2.0-beta1
  • Version 8.2.0-beta2
  • Version 8.2.0-beta3
  • Version 8.2.0-rc1
  • Version 8.2.0-rc2
  • Version 8.2.0
  • Version 8.2.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-6381
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-6381