{"id":"CVE-2017-6920","published":"2018-08-06T15:00:00Z","modified":"2024-09-16T18:33:33Z","title":"Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not…","vendor":"Drupal.org","product":"Drupal Core","tier":"tail","description":{"text":"Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.20239,"percentile":0.97458,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/99211","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.securitytracker.com/id/1038781","tags":["vdb-entry","x_refsource_SECTRACK"]}],"priority":{"score":19.5,"factors":[{"name":"EPSS percentile","points":19.49}]},"vendorSlug":"drupal-org","affectedVersions":[{"vendor":"Drupal.org","product":"Drupal Core","versions":["8 prior to 8.3.4"]}],"affected":[{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.0, <8.3.4"],"patched":["8.3.4"],"from":["GHSA-9c24-g32g-35rj"],"provenance":"source"},{"ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=8.0, <8.3.4"],"patched":["8.3.4"],"from":["GHSA-9c24-g32g-35rj"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3347","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2017-6379","published":"2017-03-16","fixed":"8.2.7","kev":false},{"cve":"CVE-2017-6381","published":"2017-03-16","fixed":"8.2.7","kev":false},{"cve":"CVE-2017-6919","published":"2017-04-20","fixed":"8.3.1","kev":false,"link":{"from":"CVE-2017-6919","to":"CVE-2017-6920","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/drupal","fromFixed":"8.3.1","toFixed":"8.3.4","daysApart":473},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"8.3.1","toFixed":"8.3.4","daysApart":473}]}},{"cve":"CVE-2017-6920","published":"2018-08-06","fixed":"8.3.4","kev":false},{"cve":"CVE-2017-6921","published":"2019-01-15","fixed":"8.3.4","kev":false},{"cve":"CVE-2017-6922","published":"2019-01-22","fixed":"8.3.4","kev":false},{"cve":"CVE-2017-6923","published":"2019-01-22","fixed":"8.3.7","kev":false}],"package":"Packagist:drupal/drupal"}}