Drupal patches two critical remote-code flaws across all supported versions
Drupal has patched two critical remote-code-execution vulnerabilities affecting all supported versions of its content management system: one in the core Field UI module and one in the Entity List module. The project warned that exploits could emerge within hours or days; at least one known attack path for each flaw does not require authentication, but relies on contributed modules or custom code.
Bottom line — Drupal’s fixed releases are 10.6.19, 11.3.19 and 11.4.10; Entity List users should update to 3.0.10.
Go deeper 5
-
BleepingComputer reports that Drupal recommends updating core and Entity List promptly.
-
BleepingComputer says administrators unable to upgrade can mitigate one exposure by uninstalling the core Field UI module.
-
Drupal 12 pre-releases before beta2 are also affected, but are not intended for production, BleepingComputer reports.
-
Drupal’s security team said versions before 10.6.x and Drupal 11 versions before 11.3.x are end-of-life and unsupported.
-
Linux.org.hk reports that no public proof-of-concept code was available at the time of its report.