Arbitrary code execution in Drupal - #VU583

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU583

Arbitrary code execution in Drupal - #VU583

Published: September 21, 2016


Vulnerability identifier: #VU583
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Drupal
Affected software:
Drupal

Detailed vulnerability description

The vulnerability allows a remote user to cause arbitrary code execution on the target system.
The weakness exists due to improper Apache configurations allowing attackers to invoke execution of carefully named arbitrary scripts in the files directory.
Successful exploitation of the vulnerability allows a malicious user to cause arbitrary code execution on the vulnerable system.

Remediation


Sources