Deserialization in Drupal
CVE-2019-6338
In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refe…
Vulnerability class: Insecure Deserialization
EPSS: 0.021 (79.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Drupal
- Drupal Core — versions 7.x, 8.6.x, 8.5.x
- Debian Debian_linux — versions 8.0, 9.0
Weakness classification (CWE)
References
- mlhess@drupal.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- mlhess@drupal.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
- mlhess@drupal.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
- mlhess@drupal.org (Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2019-6338?
- CVE-2019-6338 is a high-severity vulnerability in Drupal, classified under Deserialization of Untrusted Data. CVSS score: 8.0/10. Published 2019-01-22.
- How severe is CVE-2019-6338?
- High severity. CVSS v3 base score is 8.0 out of 10.