dbcve.org
Actively exploited in the wild. This CVE is on the CISA Known Exploited Vulnerabilities list — treat remediation as urgent. Federal remediation due by 15 Apr 2022.
DrupalCMS

CVE-2019-6340

HIGH · 8.1 CVSS v3.1 Published 2019-02-21
Fix available
A fix is available. Upgrade to 8.5.11 / 8.6.10 or later.
See remediation →
100/100
Remediation priority · Urgent
In the wild High EPSS Public exploit Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Drupal 8.5.x before 8.5.11 and 8.6.x before 8.6.10 have a vulnerability where certain field types fail to properly sanitize data from non-form sources, specifically REST API endpoints. When the RESTful Web Services module is enabled and accepts PATCH or POST requests, or when other web services modules like JSON:API are active, this can allow unauthenticated attackers to execute arbitrary PHP code.

MitigationUpdate Drupal core to version 8.5.11, 8.6.10, or later. Alternatively, disable the RESTful Web Services module or restrict REST API access if web services are not required.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
DrupalCMS
Affected:>= 8.5.0, < 8.5.11>= 8.6.0, < 8.6.10

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check Drupal core version
    Locate the CHANGELOG.txt file in the Drupal root directory and find the version line near the top, or run 'drush status' and look for the 'Drupal version' field
    Affected if The installed version is 8.5.0 through 8.5.10, or 8.6.0 through 8.6.9 (versions below 8.5.11 or 8.6.10 are affected)
  2. Verify RESTful Web Services module status
    Run 'drush pm-list --status=enabled' and look for 'RESTful Web Services' in the list, or query the system table in the database: SELECT name FROM system WHERE name='rest' AND status='1'
    Affected if The RESTful Web Services module (module name 'rest') is enabled and accepting PATCH or POST requests
  3. Verify JSON:API module status
    Run 'drush pm-list --status=enabled' and look for 'JSON:API' in the list, or query the system table: SELECT name FROM system WHERE name='jsonapi' AND status='1'
    Affected if The JSON:API module is enabled (this provides an alternative attack vector for the same vulnerability)

You are affected if your Drupal core version is 8.5.x before 8.5.11 or 8.6.x before 8.6.10 AND either the RESTful Web Services module, JSON:API module, or similar web services module is enabled.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 8.5.11 / 8.6.10 or later
Fixed in 8.5.118.6.10
Vendor patch www.exploit-db.com →
Interim mitigation

Update Drupal core to version 8.5.11, 8.6.10, or later. Alternatively, disable the RESTful Web Services module or restrict REST API access if web services are not required.

Recommended fix High confidence

Drupal 8.5.11 or 8.6.10 (latest stable 8.x release)

  1. Backup your Drupal site database and files before proceeding
  2. Ensure you have a restore point in case of issues
  3. Run the appropriate package manager command to update Drupal core (e.g., composer update drupal/core --with-all-dependencies for Composer-based installations)
  4. Alternatively, download Drupal 8.5.11 or 8.6.10 from the official Drupal website and follow the standard upgrade procedure
  5. Clear all Drupal caches after the upgrade using 'drush cr' or through the admin interface
  6. Verify the site functionality after upgrade
  7. If using RESTful Web Services (rest) module, verify API endpoints are functioning correctly
  8. For additional security, review and restrict REST API permissions to only trusted users
Caveat Standard Drupal minor version upgrade; review release notes for any deprecated APIs or configuration changes in 8.5.11/8.6.10

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Drupal Exploited in the wild — priority engagement
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing12.0 h
  • Review / QA4.0 h
28.0 hours of engineering $4,760
Get it fixed fast

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $7,616.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2019-6340 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2019-6340 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data