CVE-2019-6339
Last modified
CVE-2019-6339 is a vulnerability of currently unknown severity. In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability. EPSS estimates a 33.23% chance of exploitation in the next 30 days.
Description
In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability. This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Drupal | Drupal | >= 7.0, < 7.62 |
| Drupal | Drupal | >= 8.5.0, < 8.5.9 |
| Drupal | Drupal | >= 8.6.0, < 8.6.6 |
| Debian | Debian Linux | 8.0 |
| Debian | Debian Linux | 9.0 |
References
- https://lists.debian.org/debian-lts-announce/2019/02/msg00004.htmlThird Party Advisory
- https://www.debian.org/security/2019/dsa-4370Third Party Advisory
- https://www.drupal.org/sa-core-2019-002Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2019/02/msg00004.htmlThird Party Advisory
- https://www.debian.org/security/2019/dsa-4370Third Party Advisory
- https://www.drupal.org/sa-core-2019-002Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-6339?
How severe is CVE-2019-6339?
How do I fix CVE-2019-6339?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-6332A potential security vulnerability has been identified with …4.8
- CVE-2019-6333A potential security vulnerability has been identified with …6.7
- CVE-2019-6334HP LaserJet, PageWide, OfficeJet Enterprise, and LaserJet Ma…9.8
- CVE-2019-6335A potential security vulnerability has been identified with …7.5
- CVE-2019-6337For the printers listed a maliciously crafted print file mig…5.2
- CVE-2019-6338In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.…
- CVE-2019-6340Some field types do not properly sanitize data from non-form…8.1
- CVE-2019-6341In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prio…
- CVE-2019-6342An access bypass vulnerability exists when the experimental …9.8
- CVE-2019-6438SchedMD Slurm before 17.11.13 and 18.x before 18.08.5 mishan…
- CVE-2019-6439examples/benchmark/tls_bench.c in a benchmark tool in wolfSS…
- CVE-2019-6440Zemana AntiMalware before 3.0.658 Beta mishandles update log…
Are you affected by CVE-2019-6339?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST