Skip to content

CVE-2019-6340

Deserialization of Untrusted Data — is CVE-2019-6340real, exploitable, or a false positive? Here's the community ground truth.

☆ Watch
High · CVSS 8.1EPSS 91.9%CISA KEVCWE-502 · Deserialization of Untrusted Data

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

References

NVD MITRE CVE.org CISA KEV

Published

Embed this verdict
TruePositive verdict for CVE-2019-6340
Markdown
[![TruePositive verdict](https://www.truepositive.app/cve/CVE-2019-6340/badge.svg)](https://www.truepositive.app/cve/CVE-2019-6340)
HTML
<a href="https://www.truepositive.app/cve/CVE-2019-6340"><img src="https://www.truepositive.app/cve/CVE-2019-6340/badge.svg" alt="TruePositive verdict for CVE-2019-6340"></a>

Live badge — updates automatically as the community verdict changes.

Community ground truth

Community verdict

2 verdicts
Not a real issue

Includes TruePositive's curated baseline from public sources — community verdicts accrue on top.

to add your verdict.

Community real-world severity: High (High 2) — CVSS base score 8.1

In line with its CVSS base score.

Field notes & remediation

Verdicts are the quick signal — notes are the evidence and fixes behind them.

  • 0
    Field note · Tomáš NovákCurated

    Drupal Core Remote Code Execution Vulnerability — In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. Listed in the CISA KEV catalog (added 2022-03-25) — confirmed exploited in the wild, not theoretical. FIRST EPSS puts the chance of exploitation in the next 30 days at ~92%. Treat it as real and prioritize remediation over triage.

  • 0
    Remediation · Lin WeiCurated

    Required action for Drupal Core: Apply updates per vendor instructions. CISA set a federal remediation due date of 2022-04-15. After patching, verify the vulnerable path is no longer reachable before closing the finding.

Related CVEs

Same weakness — CWE-502 · Deserialization of Untrusted Data.