VYPR
← All advisories
High severity8.1NVD Advisory· Published Mar 16, 2017· Updated Jun 17, 2026

CVE-2017-6381

CVE-2017-6381

Description

A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable, you can remove the /vendor/phpunit directory from your production deployments

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
drupal/corePackagist
>= 8.0, < 8.2.78.2.7
drupal/drupalPackagist
>= 8.0, < 8.2.78.2.7

Affected products

63
  • Drupal/Drupal60 versions
    cpe:2.3:a:drupal:drupal:8.0.0:*:*:*:*:*:*:*+ 59 more
    • cpe:2.3:a:drupal:drupal:8.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:alpha10:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:alpha11:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:alpha12:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:alpha13:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:alpha14:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:alpha15:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:alpha2:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:alpha3:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:alpha4:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:alpha5:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:alpha6:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:alpha7:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:alpha8:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:alpha9:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:beta10:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:beta11:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:beta12:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:beta13:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:beta14:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:beta15:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:beta16:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:beta2:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:beta3:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:beta4:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:beta6:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:beta7:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:beta9:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:rc3:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.0:rc4:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.1.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.1.0:beta2:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.1.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.1.10:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.1.6:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.1.7:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.1.8:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.1.9:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.2.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.2.0:beta2:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.2.0:beta3:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.2.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.2.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:drupal:drupal:8.2.1:*:*:*:*:*:*:*
  • ghsa-coords2 versions
    pkg:composer/drupal/corepkg:composer/drupal/drupal
    >= 8.0, < 8.2.7+ 1 more
    • (no CPE)range: >= 8.0, < 8.2.7
    • (no CPE)range: >= 8.0, < 8.2.7
  • Drupal/Drupal Corecpe-rescue
    Range: 8.2.x versions before 8.2.7

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.