UpHeron
All vulnerabilities

Servers and applications

CVE-2019-6338

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details

Severity
High 8.0
Published
22 Jan 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.62, 8.5.9, 8.6.6
Exploit chance
2.1% in the next 30 daysHigher than 82% of CVEs. EPSS by FIRST, 10 Nov 2026
Weakness
Deserialization of untrusted data (CWE-502)
Attack
Over the network · Needs a user account · Needs someone to click or open something
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Sources
NVD

Affected software

SoftwareAffected versions
DrupalServers and applications · cpe:a:drupal:drupal
  • From 7.0 before 7.62
  • From 8.5.0 before 8.5.9
  • From 8.6.0 before 8.6.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-6338
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-6338