CVE-2017-6920

Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.

Score

CVSS 3.0 9.8 Critical

Status

Modified - mlhess@drupal.org

Published

2018-08-06

Last modified

2024-09-16

Weaknesses

CWE-19

Affected products

• Drupal (Drupal)
• Drupal Core (Drupal.org)

References

• http://www.securityfocus.com/bid/99211
• http://www.securitytracker.com/id/1038781
• https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple