Remote code execution in Drupal - #VU454

Vulnerability identifier: #VU454

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: N/A

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Drupal

Affected software:
Drupal

The vulnerability allows a remote user to cause code execution on the target system.
The weakness is caused by problems with Apache web server configurations that may result in code execution.
Successful exploitation of the vulnerability will allow a remote attacker to perform code execution on the vulnerable system.

Update 6.x to 6.29.
https://www.drupal.org/drupal-6.29-release-notes
Update 7.x to 7.24.
https://www.drupal.org/drupal-7.24-release-notes

• https://www.drupal.org/SA-CORE-2013-003