HomePentest-Tools.com Logo

Drupal Multiple Vulnerabilities (SA-CORE-2022-016) - Windows CVE-2022-39261

Severity
CVSSv3 Score
7.5
Vulnerability description

Drupal is prone to multiple vulnerabilities.

Risk description

Drupal uses the Twig third-party library for content templating and sanitization. Twig has released a security update that affects Drupal. Twig has rated the vulnerability as high severity. Drupal cores code extending Twig has also been updated to mitigate a related vulnerability. Multiple vulnerabilities are possible if an untrusted user has access to write Twig code, including potential unauthorized read access to private files, the contents of other files on the server, or database credentials. The vulnerability is mitigated by the fact that an exploit is only possible in Drupal core with a restricted access administrative permission. Additional exploit paths for the same vulnerability may exist with contributed or custom code that allows users to write Twig templates.

Recommendation

Update to version 9.3.22, 9.4.7 or later.

Codename
Not available
Detectable with
Network Scanner
Scan engine
OpenVAS
Exploitable with Sniper
No
CVE Published
Sep 28, 2022
Detection added at
Software Type
Not available
Vendor
Not available
Product
Not available