Description

Drupal Core is prone to a directory traversal vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks. Drupal Core versions 9.1.x ranging from 9.1.0 and up to and including 9.1.10 are vulnerable.

Remediation

Update to Drupal Core version 9.1.11 or latest

References

https://www.drupal.org/sa-core-2021-004

https://github.com/pear/Archive_Tar/commit/b5832439b1f37331fb4f87e67fe4f

Related Vulnerabilities

SharePoint CVE-2024-43466 Vulnerability (CVE-2024-43466)

Python Improper Neutralization of Special Elements used in a Command ('Command Injection') Vulnerability (CVE-2015-20107)

WordPress Plugin Advanced Custom Fields PRO Arbitrary File Upload (5.12.2)

Next.js Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2018-6184)

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark Server-Side Request Forgery (2.1.6)

Severity

High

Classification

CVE-2021-32610 CWE-22 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Directory Traversal