Improper input validation in Drupal

CVE-2012-5653

The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.017 (75.1th percentile) — read the EPSS interpretation.

Affected products

Drupal — versions 7.0, 7.1, 7.2
Debian Debian_linux — versions 6.0, 7.0
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

secalert@redhat.com (x_refsource_OSVDB, vdb-entry, Broken Link)
secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch)
secalert@redhat.com (vendor-advisory, x_refsource_MANDRIVA, Broken Link)
secalert@redhat.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
secalert@redhat.com (Third Party Advisory, vdb-entry, x_refsource_BID)
secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch)
secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Third Party Advisory)
secalert@redhat.com (vdb-entry, x_refsource_XF)