{"id":7671,"date":"2018-10-24T02:20:36","date_gmt":"2018-10-24T02:20:36","guid":{"rendered":"http:\/\/blog.nsfocusglobal.com\/?p=1746"},"modified":"2018-10-24T02:20:36","modified_gmt":"2018-10-24T02:20:36","slug":"drupal-remote-code-execution-vulnerability-threat-alert","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/drupal-remote-code-execution-vulnerability-threat-alert\/","title":{"rendered":"Drupal Remote Code Execution Vulnerability Threat Alert"},"content":{"rendered":"

Overview<\/h2>\n

Recently, Drupal released an official security advisory to announce the fixes for multiple security issues, including two critical remote code execution vulnerabilities which affect Drupal 7 and 8.<\/p>\n

The two critical vulnerabilities are described as follows:<\/p>\n

    \n
  1. Injection in DefaultMailSystem::mail() – Critical – Remote Code Execution<\/strong><\/li>\n<\/ol>\n

    When an email is sent, some variables are passed to shell for execution without proper handling, which could lead to remote code execution.<\/p>\n

      \n
    1. Contextual Links Authentication \u2013 Critical \u2013 Remote Code Execution<\/strong><\/li>\n<\/ol>\n

      The Contextual Links module does not sufficiently validate the requested contextual links, potentially leading to remote code execution. This vulnerability can only be exploited by attackers with access to contextual links.<\/p>\n

      For more details, see Drupal’s official security advisories from the following link:<\/p>\n

      https:\/\/www.drupal.org\/sa-core-2018-006<\/strong><\/a><\/p>\n

      Affected Versions<\/h2>\n