8.1

CVE-2017-6381

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the <siteroot>/vendor/phpunit directory from your production deployments
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Drupal ≫ Drupal Version 8.0.0
Drupal ≫ Drupal Version 8.0.0 Update alpha10
Drupal ≫ Drupal Version 8.0.0 Update alpha11
Drupal ≫ Drupal Version 8.0.0 Update alpha12
Drupal ≫ Drupal Version 8.0.0 Update alpha13
Drupal ≫ Drupal Version 8.0.0 Update alpha14
Drupal ≫ Drupal Version 8.0.0 Update alpha15
Drupal ≫ Drupal Version 8.0.0 Update alpha2
Drupal ≫ Drupal Version 8.0.0 Update alpha3
Drupal ≫ Drupal Version 8.0.0 Update alpha4
Drupal ≫ Drupal Version 8.0.0 Update alpha5
Drupal ≫ Drupal Version 8.0.0 Update alpha6
Drupal ≫ Drupal Version 8.0.0 Update alpha7
Drupal ≫ Drupal Version 8.0.0 Update alpha8
Drupal ≫ Drupal Version 8.0.0 Update alpha9
Drupal ≫ Drupal Version 8.0.0 Update beta1
Drupal ≫ Drupal Version 8.0.0 Update beta10
Drupal ≫ Drupal Version 8.0.0 Update beta11
Drupal ≫ Drupal Version 8.0.0 Update beta12
Drupal ≫ Drupal Version 8.0.0 Update beta13
Drupal ≫ Drupal Version 8.0.0 Update beta14
Drupal ≫ Drupal Version 8.0.0 Update beta15
Drupal ≫ Drupal Version 8.0.0 Update beta16
Drupal ≫ Drupal Version 8.0.0 Update beta2
Drupal ≫ Drupal Version 8.0.0 Update beta3
Drupal ≫ Drupal Version 8.0.0 Update beta4
Drupal ≫ Drupal Version 8.0.0 Update beta6
Drupal ≫ Drupal Version 8.0.0 Update beta7
Drupal ≫ Drupal Version 8.0.0 Update beta9
Drupal ≫ Drupal Version 8.0.0 Update rc1
Drupal ≫ Drupal Version 8.0.0 Update rc2
Drupal ≫ Drupal Version 8.0.0 Update rc3
Drupal ≫ Drupal Version 8.0.0 Update rc4
Drupal ≫ Drupal Version 8.0.1
Drupal ≫ Drupal Version 8.0.2
Drupal ≫ Drupal Version 8.0.3
Drupal ≫ Drupal Version 8.0.4
Drupal ≫ Drupal Version 8.0.5
Drupal ≫ Drupal Version 8.0.6
Drupal ≫ Drupal Version 8.1.0
Drupal ≫ Drupal Version 8.1.0 Update beta1
Drupal ≫ Drupal Version 8.1.0 Update beta2
Drupal ≫ Drupal Version 8.1.0 Update rc1
Drupal ≫ Drupal Version 8.1.1
Drupal ≫ Drupal Version 8.1.2
Drupal ≫ Drupal Version 8.1.3
Drupal ≫ Drupal Version 8.1.4
Drupal ≫ Drupal Version 8.1.5
Drupal ≫ Drupal Version 8.1.6
Drupal ≫ Drupal Version 8.1.7
Drupal ≫ Drupal Version 8.1.8
Drupal ≫ Drupal Version 8.1.9
Drupal ≫ Drupal Version 8.1.10
Drupal ≫ Drupal Version 8.2.0
Drupal ≫ Drupal Version 8.2.0 Update beta1
Drupal ≫ Drupal Version 8.2.0 Update beta2
Drupal ≫ Drupal Version 8.2.0 Update beta3
Drupal ≫ Drupal Version 8.2.0 Update rc1
Drupal ≫ Drupal Version 8.2.0 Update rc2
Drupal ≫ Drupal Version 8.2.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.9% 0.889
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.2 5.9
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-829 Inclusion of Functionality from Untrusted Control Sphere

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

http://www.securityfocus.com/bid/96919
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038058
https://www.drupal.org/SA-2017-001
Vendor Advisory
Mitigation