DRUPAL-CONTRIB-2018-022unknown
DRUPAL-CONTRIB-2018-022
No CVE assignedCheck your stack
The advisory, in context
This module enables you to monitor and manage any number of remote Drupal sites and aggregate useful information for administrators in a central dashboard.
The modules (DRD and DRD Agent) encrypt the data which is exchanged between them but in order to do so, they use the PHP serialize/unserialize functions instead of the json_encode/json_decode combination. As the unserialize function is called on unauthenticated content, this introduces a PHP object injection vulnerability.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/drd_agent Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 3.7.0
Fixed in 3.7.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.0"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<3.7.0"
}
}
],
"versions": []
}