Cybersecurity
Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
Original report by info@thehackernews.com (The Hacker News)
Summarized by News Era from reporting by thehackernews.com. How we work
What Happened?
Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Several exploit paths exist through contributed modules, and at least one known path needs no login.
Key Takeaways
- 1Drupal core contained a critical flaw in its Field UI module. This flaw could allow an attacker to run code on the site's server. Fixes were released on October 14 in Drupal versions 11.4.10, 11.3.19, and 10.6.19.
Summary written with AI from the story's source text.
Get the News Era newsletter
The most important tech and cybersecurity stories, delivered to your inbox. Free, and you can unsubscribe at any time.