Resource exhaustion in Drupal - CVE-2014-5267,CVE-2014-5266,CVE-2014-5265
Published: September 14, 2016 / Updated: November 22, 2018
Vulnerability identifier: #VU446
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-5267,CVE-2014-5266,CVE-2014-5265
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote user to cause denial of service on the target system.
The weakness is caused by vulnerability of PHP XML parser used by XML-RPC endpoint (xmlrpc.php) to attacks connected with XML payload. The attackers can cause CPU and memory exhaustion, open the maximum number of connection in the site's database that can result in denial of service.
Successful exploitation of this vulnerability may lead to denial of service on the vulnerable system.
The weakness is caused by vulnerability of PHP XML parser used by XML-RPC endpoint (xmlrpc.php) to attacks connected with XML payload. The attackers can cause CPU and memory exhaustion, open the maximum number of connection in the site's database that can result in denial of service.
Successful exploitation of this vulnerability may lead to denial of service on the vulnerable system.
Affected software
Drupal
Debian Linux
Fedora
wordpress
drupal6
drupal7
Debian Linux
Fedora
wordpress
drupal6
drupal7
How to mitigate CVE-2014-5267,CVE-2014-5266,CVE-2014-5265
Update 6.x to 6.33.
https://www.drupal.org/drupal-6.33-release-notes
Update 7.x to 7.31.
https://www.drupal.org/drupal-7.31-release-notes
https://www.drupal.org/drupal-6.33-release-notes
Update 7.x to 7.31.
https://www.drupal.org/drupal-7.31-release-notes
wordpress - addressed in versions 3.9.2-3.el5, 3.9.2-3.el6
drupal6 - addressed in versions 6.33-1.el5, 6.33-1.el6
drupal7 - addressed in versions 7.31-1.el5, 7.31-1.el6
drupal6 - addressed in versions 6.33-1.el5, 6.33-1.el6
drupal7 - addressed in versions 7.31-1.el5, 7.31-1.el6