Vulnerability Bulletins |
Drupal core - Moderately critical - Multiple vulnerabilities - SA-CORE-2019-010 |
|
| Affected software | Drupal |
|
Project: Drupal coreVersion: 8.8.x-dev8.7.x-devDate: 2019-December-18Security risk: Moderately critical 14∕25 AC:Basic/A:Admin/CI:Some/II:All/E:Theoretical/TD:DefaultVulnerability: Multiple vulnerabilitiesDescription: Drupal 8 cores file_save_upload() function does not strip the leading and trailing dot (.) from filenames, like Drupal 7 did.Users with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such More info: https://www.drupal.org/sa-core-2019-010 |
|