According to its self-reported version, the instance of Drupal running on the remote web server is 8.5.x prior to 8.5.11 or 8.6.x prior to 8.6.10. It is, therefore, affected by a remote code execution vulnerability due to improper sanitization of data from non-form sources.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Drupal Security Team

Some field types do not properly sanitize data from non-form sources.
This can lead to arbitrary PHP code execution in some cases..

According to its self-reported version, the instance of Drupal running on the remote web server is 8.5.x prior to 8.5.11, or 8.6.x prior to 8.6.10. It is, therefore, affected by a remote code execution vulnerability due to improper sanitization of data from non-form sources.

The Drupal CMS installed on the remote host is affected by a remote command execution vulnerability. A remote, unauthenticated attacker can leverage this issue to execute arbitrary commands on the remote host.

The version of Drupal installed on the remote server is 8.5.x prior to 8.5.11, and is affected by a flaw in the 'Memcache::getextendedstats' function that can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached server hostnames and/or ports. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code.

The version of Drupal installed on the remote server is 8.6.x prior to 8.6.10, and is affected by a flaw in the 'Memcache::getextendedstats' function that can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached server hostnames and/or ports. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code.

ID	Name	Product	Family	Published	Updated	Severity
98589	Drupal 8.6.x < 8.6.10 Remote Code Execution Vulnerability	Web App Scanning	Component Vulnerability	2/21/2019	3/14/2023	high
98588	Drupal 8.5.x < 8.5.11 Remote Code Execution Vulnerability	Web App Scanning	Component Vulnerability	2/21/2019	3/14/2023	high
122372	FreeBSD : drupal -- Drupal core - Highly critical - Remote Code Execution (002b4b05-35dd-11e9-94a8-000ffec0b3e1)	Nessus	FreeBSD Local Security Checks	2/22/2019	3/20/2025	high
122349	Drupal 8.5.x < 8.5.11 / 8.6.x < 8.6.10 Remote Code Execution (SA-CORE-2019-003)	Nessus	CGI abuses	2/20/2019	3/20/2025	high
122449	Drupal Remote Code Execution Vulnerability (SA-CORE-2019-003) (exploit)	Nessus	CGI abuses	2/27/2019	7/14/2025	high
700419	Drupal 8.5.x < 8.5.11 RCE (SA-CORE-2019-003)	Nessus Network Monitor	CGI	2/20/2019	3/6/2019	critical
700420	Drupal 8.6.x < 8.6.10 RCE (SA-CORE-2019-003)	Nessus Network Monitor	CGI	2/20/2019	3/6/2019	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

critical

critical