Description
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
Remediation
References
Related Vulnerabilities
Jboss EAP Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2018-10237)
Oracle Database Server CVE-2011-2242 Vulnerability (CVE-2011-2242)
Drupal Core 4.7.x Multiple Cross-Site Scripting Vulnerabilities (4.7.0 - 4.7.6)
WordPress Plugin DELUCKS SEO Unspecified Vulnerability (1.2.2)
WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2019-20330)