Description
Drupal Core is prone to multiple vulnerabilities, including security bypass, denial of service, open redirect and information disclosure vulnerabilities. Exploiting these issues could allow an attacker to perform otherwise restricted actions and subsequently view, delete or substitute a link to a file, to cause the affected website to consume memory and CPU resources by blocking file uploads, thus denying service to legitimate users, to redirect users to arbitrary web sites and conduct phishing attacks or to obtain sensitive information that may help in launching further attacks. Drupal Core versions 8.0.x ranging from 8.0.0 and up to and including 8.0.3 are vulnerable.
Remediation
Update to Drupal Core version 8.0.4 or latest
References
Related Vulnerabilities
ReviveAdserver Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2013-5954)
XWiki Incorrect Authorization Vulnerability (CVE-2024-38369)
Ruby on Rails Inefficient Regular Expression Complexity Vulnerability (CVE-2023-22795)
IBM WebSEAL CVE-2018-1813 Vulnerability (CVE-2018-1813)
WordPress Plugin Newsletter Meenews 'idnews' Parameter Cross-Site Scripting (5.1.0)