Vulnerability in Drupal.org Drupal Core
CVE-2017-6920
Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.
EPSS: 0.661 (98.5th percentile) — read the EPSS interpretation.
Affected products
- Drupal.org Drupal Core — versions 8 prior to 8.3.4
Public proof-of-concept exploits
References
- www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21… (x_refsource_CONFIRM)
- 99211 (vdb-entry, x_refsource_BID)
- 1038781 (vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2017-6920?
- CVE-2017-6920 is a vulnerability in Drupal.org Drupal Core. Published 2018-08-06.
- Is CVE-2017-6920 known to be exploited?
- 18 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.