{"id":"CVE-2019-6340","published":"2019-02-21T21:29:00Z","modified":"2026-06-17T02:39:02Z","title":"Drupal Core Remote Code Execution Vulnerability","vendor":"Drupal","product":"Core","tier":"core","eol":null,"description":{"text":"Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)","provenance":"source","from":"NVD"},"summary":{"text":"Drupal Core contains a flaw where some field types fail to properly sanitize data arriving from non-form sources in Drupal 8.5.x before 8.5.11 and 8.6.x before 8.6.10, enabling untrusted data deserialization. An unauthenticated remote attacker can, in some cases, execute arbitrary PHP code, but only on sites that have the core RESTful Web Services (rest) module enabled with PATCH or POST allowed, or another web services module such as JSON:API (or Services/RESTful Web Services on Drupal 7) enabled.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:38Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.92017,"percentile":0.9982,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-6340","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-12-27","exploitedFirstSeen":"2019-12-27","ransomware":false,"evidence":[{"url":"https://blog.sonicwall.com/en-us/2019/12/top-cves-exploited-in-the-wild-in-the-year-2019/","date":"2019-12-27"},{"url":"https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/","date":"2021-04-12"},{"url":"https://www.lacework.com/blog/spytech-necro-keksecs-latest-python-malware/","date":"2021-10-13"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2019-6340","date":"2023-11-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-01&host_type=src&vulnerability=cve-2019-6340","date":"2024-03-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-04&host_type=src&vulnerability=cve-2019-6340","date":"2024-03-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-09&host_type=src&vulnerability=cve-2019-6340","date":"2025-06-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-13&host_type=src&vulnerability=cve-2019-6340","date":"2025-07-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-14&host_type=src&vulnerability=cve-2019-6340","date":"2025-07-14"}],"evidenceTotal":20,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"http://www.securityfocus.com/bid/107106","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.drupal.org/sa-core-2019-003","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/46452/","tags":["Patch","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/46459/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/46510/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_19_09","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/107106","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.drupal.org/sa-core-2019-003","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/46452/","tags":["Patch","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/46459/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/46510/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_19_09","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340","tags":["US Government Resource"]}],"techniques":[{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1566.001","name":"Spearphishing Attachment","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: web service endpoints accept untrusted remote requests","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows PATCH or POST requests","start":345,"end":374}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary PHP code execution from crafted input","mappingType":"primary_impact","evidence":[{"from":"description","quote":"can lead to arbitrary PHP code execution","start":136,"end":176}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.6.0, <8.6.10",">=7.0.0, <7.62.0",">=8.0.0, <8.5.11"],"patched":["8.6.10","7.62.0","8.5.11"],"from":["GHSA-3gx6-h57h-rm27","DRUPAL-CORE-2019-003"],"provenance":"source"},{"ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=7.0.0, <7.62.0",">=8.0.0, <8.5.11",">=8.6.0, <8.6.10"],"patched":["7.62.0","8.5.11","8.6.10"],"from":["GHSA-3gx6-h57h-rm27"],"provenance":"source"}],"advisories":[{"id":"GHSA-3gx6-h57h-rm27","url":"https://github.com/advisories/GHSA-3gx6-h57h-rm27","severity":"HIGH","ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.6.0, <8.6.10"],"patched":["8.6.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3gx6-h57h-rm27","url":"https://github.com/advisories/GHSA-3gx6-h57h-rm27","severity":"HIGH","ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=7.0.0, <7.62.0"],"patched":["7.62.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3gx6-h57h-rm27","url":"https://github.com/advisories/GHSA-3gx6-h57h-rm27","severity":"HIGH","ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.0.0, <8.5.11"],"patched":["8.5.11"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3gx6-h57h-rm27","url":"https://github.com/advisories/GHSA-3gx6-h57h-rm27","severity":"HIGH","ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=7.0.0, <7.62.0"],"patched":["7.62.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3gx6-h57h-rm27","url":"https://github.com/advisories/GHSA-3gx6-h57h-rm27","severity":"HIGH","ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=8.0.0, <8.5.11"],"patched":["8.5.11"],"provenance":"source","from":"GHSA"},{"id":"GHSA-3gx6-h57h-rm27","url":"https://github.com/advisories/GHSA-3gx6-h57h-rm27","severity":"HIGH","ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=8.6.0, <8.6.10"],"patched":["8.6.10"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-2184","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2184","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[{"id":46452,"url":"https://www.exploit-db.com/exploits/46452","title":"Drupal < 8.6.10 / < 8.5.11 - REST Module Remote Code Execution","type":"webapps","platform":"php","date":"2019-02-23","verified":false,"provenance":"source"},{"id":46459,"url":"https://www.exploit-db.com/exploits/46459","title":"Drupal < 8.6.9 - REST Module Remote Code Execution","type":"webapps","platform":"php","date":"2019-02-25","verified":false,"provenance":"source"},{"id":46510,"url":"https://www.exploit-db.com/exploits/46510","title":"Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit)","type":"remote","platform":"php","date":"2019-03-07","verified":true,"provenance":"source"},{"id":46510,"url":"https://www.exploit-db.com/exploits/46510","title":"Drupal < 8.5.11 / < 8.6.10 - RESTful Web Services unserialize() Remote Command Execution (Metasploit)","type":"remote","platform":"php","date":"2019-03-07","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2019-02-23"},"pocGithub":{"count":10,"skipped":1,"earliest":"2019-02-22","earliestUrl":"https://github.com/g0rx/Drupal-SA-CORE-2019-003","repos":[{"name":"jas502n/CVE-2019-6340","url":"https://github.com/jas502n/CVE-2019-6340","stars":71,"created":"2019-05-27"},{"name":"knqyf263/CVE-2019-6340","url":"https://github.com/knqyf263/CVE-2019-6340","stars":42,"created":"2019-02-23"},{"name":"g0rx/Drupal-SA-CORE-2019-003","url":"https://github.com/g0rx/Drupal-SA-CORE-2019-003","stars":30,"created":"2019-02-22"},{"name":"oways/CVE-2019-6340","url":"https://github.com/oways/CVE-2019-6340","stars":11,"created":"2019-02-25"},{"name":"ludy-dev/drupal8-REST-RCE","url":"https://github.com/ludy-dev/drupal8-REST-RCE","stars":4,"created":"2020-08-31"}]},"metasploit":[{"name":"Drupal RESTful Web Services unserialize() RCE","module":"exploit/unix/webapp/drupal_restws_unserialize","type":"exploit","disclosureDate":"2019-02-20","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/drupal_restws_unserialize.rb"}],"nuclei":[{"id":"CVE-2019-6340","name":"Drupal - Remote Code Execution","severity":"high","path":"http/cves/2019/CVE-2019-6340.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-6340.yaml"}],"first":{"date":"2019-02-20","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/drupal_restws_unserialize.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/46459/","https://www.exploit-db.com/exploits/46510/","https://www.exploit-db.com/exploits/46452/","https://www.exploit-db.com/exploits/46452","https://www.exploit-db.com/exploits/46459","https://www.exploit-db.com/exploits/46510"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1566.001","T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2019-02-20","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2019-02-22, Exploit-DB 2019-02-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/drupal_restws_unserialize.rb","provenance":"source"},{"date":"2019-02-21","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6340","provenance":"source"},{"date":"2019-12-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.sonicwall.com/en-us/2019/12/top-cves-exploited-in-the-wild-in-the-year-2019/","provenance":"source"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2184","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":1128},"priority":{"score":68.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2498 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9982"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 4 Exploit-DB entries; 1 NVD exploit link; 3 advisory exploit references; 10 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2018-7602","published":"2018-07-19","fixed":"8.5.3","kev":true,"link":{"from":"CVE-2018-7602","to":"CVE-2019-6340","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/drupal","fromFixed":"7.59","toFixed":"7.62.0","daysApart":217},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"7.59","toFixed":"7.62.0","daysApart":217}]}},{"cve":"CVE-2019-6338","published":"2019-01-22","fixed":"8.6.6","kev":false},{"cve":"CVE-2019-6339","published":"2019-01-22","fixed":"8.6.6","kev":false,"link":{"from":"CVE-2019-6339","to":"CVE-2019-6340","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/drupal","fromFixed":"8.5.9","toFixed":"8.5.11","daysApart":30},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"8.6.6","toFixed":"8.6.10","daysApart":30}]}},{"cve":"CVE-2019-6340","published":"2019-02-21","fixed":"8.6.10","kev":true},{"cve":"CVE-2019-6341","published":"2019-03-26","fixed":"8.6.13","kev":false,"link":{"from":"CVE-2019-6340","to":"CVE-2019-6341","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/drupal","fromFixed":"7.62.0","toFixed":"7.65.0","daysApart":33},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/drupal","fromFixed":"8.5.11","toFixed":"8.5.14","daysApart":33}]}},{"cve":"CVE-2019-10909","published":"2019-05-16","fixed":"8.6.15","kev":false},{"cve":"CVE-2019-11831","published":"2019-05-09","fixed":"8.7.1","kev":false}],"package":"Packagist:drupal/drupal"}}