[UPDATE] [hoch] Drupal Erweiterungen: Mehrere Schwachstellen
BSI warns of high-severity flaws across multiple Drupal extensions enabling access bypass, account takeover, and payment-status manipulation — a concern for any enterprise running Drupal-based portals.
Summary written by editorial AI · Source link below
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Erweiterungen ausnutzen, um Zugriffsbeschränkungen zu umgehen, geschützte oder sensible Inhalte offenzulegen, Benutzerkonten zu übernehmen, unberechtigte Änderungen oder Löschungen vorzunehmen, Zahlungsstatus zu manipulieren sowie Cross-Site-Scripting-Angriffe auszuführen.
Editorial Analysis
Drupal remains common in European public-sector and enterprise web estates; extension-level flaws often escape standard patch cycles and expand the attack surface significantly.
Inventory all Drupal extensions in production and staging, cross-reference with the advisory, and patch or remove affected modules within 48 hours.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at CERT-Bund (BSI) in a new tab.
More from the Vulnerabilities Desk
- Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers1d
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software2d
- Abandoned Popcorn Time app exposed millions of devices to RCE attacks3d
- HPE patches eight max severity RCE and auth bypass AOS flaws3d
- Compromised TLS Certificates3d