🔴 Critical: Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules
-
Drupal has released security updates addressing a critical vulnerability in the Field UI module of Drupal core that could allow an attacker to execute code on the site's server. The fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19.
According to the Drupal Security Team's advisory, the flaw cannot be reached through core alone. However, several exploit paths exist through contributed modules, and at least one known path requires no authentication, making unauthenticated remote code execution a realistic risk for sites running affected contributed modules.
Site administrators should upgrade to the patched releases as soon as possible:
- Drupal 11.4.10
- Drupal 11.3.19
- Drupal 10.6.19
Given the unauthenticated exploit path via contributed modules, prioritising this update is strongly advised, and reviewing which contributed modules are in use is worthwhile.
Source: The Hacker News
Does your organisation run Drupal with contributed Field UI-dependent modules, and have you scheduled the upgrade yet?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login