Drupal users were informed yesterday by developers that version 8.7.4 is affected by a serious vulnerability and were asked to update to version 8.7.5, which addresses the problem.
The vulnerability, called CVE-2019-6342, has been rated "critical." Drupal developers use NIST's Common Misuse Scoring System to determine the severity of a vulnerability. This means that a "critical" rating is second on the severity scale, after "very critical.".
The flaw, described as an access bypass issue, can be triggered when the experimental Workspaces module is enabled and exploited to take control of a website.
Dave Botsch was the one who discovered and pointed out the vulnerability to Drupal developers, and so far there is no evidence of it being exploited for malicious purposes. However, this vulnerability could be a tempting target for hackers, as it affects default/common configurations, no authentication is required, and exploitation requires minimal user interaction.
The flaw only affects Drupal 8.7.4. Drupal versions 8.7.3 and earlier, 8.6.x and earlier, and 7.x are not affected. Users who are unable to update to version 8.7.5 to fix the vulnerability can prevent potential attacks by disabling the Workspaces module.
The US Department of Homeland Security (DHS) advises users to read Drupal's recommendations and take the necessary measures.
Exploiting Drupal vulnerabilities is nothing new. Earlier this year, attackers began exploiting the CVE-2019-6340 flaw to distribute cryptocurrency miners and other payloads, just days after a patch was released.
Also last year, hackers exploited two vulnerabilities known as Drupalgeddon2 and Drupalgeddon3. Attackers used the vulnerabilities to distribute RATs, cryptocurrency miners, and tech support scams.
