CVE-2019-6340

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

• CWE-502
• CWE-502

• http://www.securityfocus.com/bid/107106Broken Link, Third Party Advisory, VDB Entry
• https://www.drupal.org/sa-core-2019-003Mitigation, Vendor Advisory
• https://www.exploit-db.com/exploits/46452/Patch, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/46459/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/46510/Exploit, Third Party Advisory
• https://www.synology.com/security/advisory/Synology_SA_19_09Third Party Advisory
• http://www.securityfocus.com/bid/107106Broken Link, Third Party Advisory, VDB Entry
• https://www.drupal.org/sa-core-2019-003Mitigation, Vendor Advisory
• https://www.exploit-db.com/exploits/46452/Patch, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/46459/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/46510/Exploit, Third Party Advisory
• https://www.synology.com/security/advisory/Synology_SA_19_09Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340US Government Resource

Published

Feb 21, 2019

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-6333A potential security vulnerability has been identified with …6.7
• CVE-2019-6334HP LaserJet, PageWide, OfficeJet Enterprise, and LaserJet Ma…9.8
• CVE-2019-6335A potential security vulnerability has been identified with …7.5
• CVE-2019-6337For the printers listed a maliciously crafted print file mig…5.2
• CVE-2019-6338In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.…
• CVE-2019-6339In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.…
• CVE-2019-6341In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prio…
• CVE-2019-6342An access bypass vulnerability exists when the experimental …9.8
• CVE-2019-6438SchedMD Slurm before 17.11.13 and 18.x before 18.08.5 mishan…
• CVE-2019-6439examples/benchmark/tls_bench.c in a benchmark tool in wolfSS…
• CVE-2019-6440Zemana AntiMalware before 3.0.658 Beta mishandles update log…
• CVE-2019-6441An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, …