CVE-2017-6381

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the <siteroot>/vendor/phpunit directory from your production deployments

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-829

Affected software

Vendor	Product	Versions
Drupal	Drupal Core	8.2.x versions before 8.2.7

References

http://www.securityfocus.com/bid/96919Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038058
https://www.drupal.org/SA-2017-001Mitigation, Vendor Advisory
http://www.securityfocus.com/bid/96919Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038058
https://www.drupal.org/SA-2017-001Mitigation, Vendor Advisory

Timeline

Published: Mar 16, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-63847.5Memory leak in the login_user function in saslserv/main.c in saslserv/main.so in Atheme 7.2.7 allows a remote unauthenticated attacker to co CVE-2017-63866.5Memory leak in the vrend_create_vertex_elements_state function in vrend_renderer.c in virglrenderer allows local guest OS users to cause a d CVE-2017-63875.5The dex_loadcode function in libr/bin/p/bin_dex.c in radare2 1.2.1 allows remote attackers to cause a denial of service (out-of-bounds read CVE-2017-63906.1An issue was discovered in whatanime.ga before c334dd8499a681587dd4199e90b0aa0eba814c1d. The vulnerability exists due to insufficient filtra CVE-2017-63916.1An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed CVE-2017-63926.1An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed CVE-2017-63936.1An issue was discovered in NagVis 1.9b12. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "nagvi CVE-2017-63946.1Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient fil CVE-2017-63956.1An issue was discovered in HashOver 2.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the 'hashov CVE-2017-63966.1An issue was discovered in WPO-Foundation WebPageTest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data pas CVE-2017-63976.1An issue was discovered in FlightAirMap v1.0-beta.10. The vulnerability exists due to insufficient filtration of user-supplied data in multi CVE-2017-63988.8An issue was discovered in Trend Micro InterScan Messaging Security (Virtual Appliance) 9.1-1600. An authenticated user can execute a termin