Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:composer/drupal/drupal@8.2.2

Type composer

Namespace drupal

Name drupal

Version 8.2.2

Qualifiers

Subpath

Is_vulnerable false

Next_non_vulnerable_version 8.2.3

Latest_non_vulnerable_version 10.0.8

Affected_by_vulnerabilities

Fixing_vulnerabilities

url VCID-tbk2-zprq-27c8

vulnerability_id VCID-tbk2-zprq-27c8

summary

Remote code execution
A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution, and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal. To be sure you aren’t vulnerable, you can remove the /vendor/phpunit directory from the site root of your production deployments.

references

reference_url	https://www.drupal.org/SA-2017-001
reference_id
reference_type
scores
url	https://www.drupal.org/SA-2017-001

reference_url	http://www.securityfocus.com/bid/96919
reference_id
reference_type
scores
url	http://www.securityfocus.com/bid/96919

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2017-6381
reference_id	CVE-2017-6381
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2017-6381

fixed_packages

url	pkg:composer/drupal/drupal@8.2.2
purl	pkg:composer/drupal/drupal@8.2.2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.2.2

aliases CVE-2017-6381

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-tbk2-zprq-27c8

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.2.2

Package Instance