Connect with us

Hi, what are you looking for?



Critical Drupal Updates Patch Several Vulnerabilities

Drupal has released versions 6.38, 7.43 and 8.0.4 to patch a total of ten vulnerabilities, including one rated critical.

Drupal has released versions 6.38, 7.43 and 8.0.4 to patch a total of ten vulnerabilities, including one rated critical.

According to an advisory published on Wednesday, the most serious vulnerability is a critical Form API access bypass issue affecting Drupal 6. An attacker can exploit the flaw to submit input associated with buttons that should be blocked for non-administrators. For example, if there is a form that both admins and non-admins can access, but certain submit buttons are only available to administrators, an attacker who has access to that form can use the restricted buttons.

The updates, which have an overall rating of “critical,” also patch a moderately critical file upload access bypass and denial-of-service (DoS) vulnerability affecting Drupal 7 and 8. The flaw, present in the File module, allows an attacker who has permission to create content and upload files to view, delete or replace a link to a file uploaded by the victim. An attacker can leverage the security hole to block all file uploads to a website.

Another moderately critical issue affects Drupal 6 and 7 and it can be leveraged to brute-force user passwords via the XML-RPC system. Developers pointed out that the vulnerability can only be exploited if a module that provides an XML-RPC method that is vulnerable to brute-forcing is present. Drupal 6 is vulnerable due to the use of the Blog API module, but there aren’t any such modules in Drupal 7.

Drupal 6, 7 and 8 are plagued by an open redirect vulnerability that can be exploited via path manipulation. Developers have also assigned a “moderately critical” rating to a reflected file download flaw in Drupal 6 and 7, and an open redirect protection bypass issue in Drupal 6.

Another Drupal 6 flaw rated “moderately critical” can be exploited for HTTP header injection attacks when user-generated content containing line breaks is passed as a header value on websites running PHP versions prior to 5.1.2.

The latest Drupal updates also fix three less critical vulnerabilities: one that can result in a user being granted all roles when a user account is saved (versions 6 and 7), an issue that allows attackers to leverage the forgotten password feature to match an email address to a username (versions 7 and 8), and a possible remote code execution bug related to user data unserialization (version 6).

The flaws patched with the release of Drupal 6.38, 7.43 and 8.0.4 have been identified by several external researchers and members of the Drupal Security Team. Users are advised to update their installations as soon as possible.

Advertisement. Scroll to continue reading.

This is the last security update released for Drupal 6, which has reached end of life on February 24. The Drupal Security Team announced that it will still be working with three vendors that want to provide paid support for Drupal 6 websites.

The companies that will receive Drupal 6 Long Term Support (D6 LTS) will publicly release all their patches on the D6 LTS project page. However, Drupal noted that the LTS vendors will likely stop providing patches if Drupal 6 website owners will not pay for their work.

Related: Unpatched Drupal Flaws Expose Sites to Attacks

Related: Drupal Starts Patching Update Process Flaws

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.