Iniciar sesión
Deutsch English Español Polski
Sin evaluar

Drupal core - SA-CORE-2021-006

  • Publicada: 15.09.2021
  • Actualizado: 11.10.2026 13:17

The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed media. In some cases, this could lead to cross-site scripting.

This advisory is not covered by Drupal Steward.

Also see Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028 which addresses a similar vulnerability for that module.

Updated 18:15 UTC to clarify text.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de Composer drupal/core >= 8.0.0, < 8.9.19, >= 9.1.0, < 9.1.13, >= 9.2.0, < 9.2.6 8.9.19, 9.1.13, 9.2.6
Paquete de Composer drupal/entity_embed < 1.2.0 1.2.0
Drupal (núcleo) drupal/core >= 8.0.0, < 8.9.19, >= 9.1.0, < 9.1.13, >= 9.2.0, < 9.2.6 8.9.19, 9.1.13, 9.2.6
Módulo de Drupal drupal/entity_embed < 1.2.0 1.2.0

Referencias

Puntuación CVSS -
Debilidad (CWE)
-
Plataforma
Composer, Drupal
Paquete
drupal/core, drupal/entity_embed
Publicada
15.09.2021
Actualizado
11.10.2026 13:17

Fuentes y licencias

OSV / GitHub Advisory Database - DRUPAL-CORE-2021-006 - CC BY-SA 2.0; code GPL-2.0-or-later

OSV / GitHub Advisory Database - DRUPAL-CONTRIB-2021-028 - CC BY-SA 2.0; code GPL-2.0-or-later

Historial de vulnerabilidades: drupal/core

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (146) en el archivo
Entradas en total
146
Primera → última
02.2018 09.2026
Sin corrección
3
Explotada en ataques
5

Distribución por gravedad

  • Crítica 15
  • Alta 40
  • Media 60
  • Baja 5
  • Sin evaluar 26

Divulgaciones por año

Gravedad:
  1. Drupal Core has a SQL Injection issue
    Crítica · 9.8 Explotada en ataques CVE-2026-9082 >= 8.9.0, < 10.4.10, >= 10.5.0, < 10.5.10, >= 10.6.0, < 10.6.9, >= 11.0.0, < 11.1.10, >= 11.2.0, < 11.2.12, >= 11.3.0, < 11.3.10 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10
  2. Drupal core contains a potential PHP Object Injection vulnerability
    Alta · 9.8 CVE-2024-55638 >= 8.8.0, < 10.2.11, >= 10.3.0, < 10.3.9, >= 7.0, < 7.102 10.2.11, 10.3.9, 7.102
  3. Drupal core contains a potential PHP Object Injection vulnerability
    Alta · 9.8 CVE-2024-55637 >= 8.8.0, < 10.2.11, >= 10.3.0, < 10.3.9, >= 11.0.0, < 11.0.8 10.2.11, 10.3.9, 11.0.8
  4. Drupal core Arbitrary PHP code execution
    Alta · 7.8 ghsa-gxxj-g9v8-w28p >= 7.0.0, < 7.75, >= 8.0.0, < 8.8.12, >= 8.9.0, < 8.9.10, >= 9.0.0, < 9.0.9 7.75, 8.8.12, 8.9.10, 9.0.9
  5. Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar
    Alta · 8.1 ghsa-98h9-727m-44qv >= 7.0.0, < 7.69, >= 8.0.0, < 8.7.11, >= 8.8.0, < 8.8.1 7.69, 8.7.11, 8.8.1
  6. Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution
    Crítica ghsa-7v68-3pr5-h3cr >= 8.0.0, < 8.5.8, >= 8.6.0, < 8.6.2 8.5.8, 8.6.2
  7. Drupal core Remote Code Execution
    Crítica ghsa-6mgp-v5cm-ghg5 >= 7.0, < 7.60, >= 8.0.0, < 8.5.8, >= 8.6.0, < 8.6.2 7.60, 8.5.8, 8.6.2
  8. Drupal core - SA-CORE-2024-001
    Alta · 7.5 CVE-2024-11941 >= 8.0.0, < 10.1.8, >= 10.2.0, < 10.2.2 10.1.8, 10.2.2
  9. Drupal core - SA-CORE-2023-006
    Crítica CVE-2023-5256 >= 8.7.0, < 9.5.11, >= 10.0.0, < 10.0.11, >= 10.1.0, < 10.1.4 9.5.11, 10.0.11, 10.1.4
  10. Drupal core - SA-CORE-2023-005
    Crítica CVE-2023-31250 >= 8.0.0, < 9.4.14, >= 9.5.0, < 9.5.8, >= 10.0.0, < 10.0.8 9.4.14, 9.5.8, 10.0.8
  11. Drupal core - SA-CORE-2022-016
    Alta · 7.5 CVE-2022-39261 >= 8.0.0, < 9.3.22, >= 9.4.0, < 9.4.7 9.3.22, 9.4.7
  12. Drupal core - SA-CORE-2022-014
    Alta · 7.2 CVE-2022-25277 >= 8.0.0, < 9.3.19, >= 9.4.0, < 9.4.3 9.3.19, 9.4.3
  13. Drupal core - SA-CORE-2022-012
    Alta · 7.5 CVE-2022-25275 >= 8.0.0, < 9.3.19, >= 9.4.0, < 9.4.3 9.3.19, 9.4.3
  14. Drupal core - SA-CORE-2022-011
    Alta · 7.5 CVE-2022-31042 >= 8.0.0, < 9.2.21, >= 9.3.0, < 9.3.16 9.2.21, 9.3.16
  15. Drupal core - SA-CORE-2022-010
    Alta · 8.0 CVE-2022-29248 >= 8.0.0, < 9.2.20, >= 9.3.0, < 9.3.14 9.2.20, 9.3.14
  16. Drupal Access Control Bypass
    Alta CVE-2011-2687 >= 7.0, < 7.3 7.3
  17. Drupal Open Redirect
    Alta · 7.4 CVE-2016-3164 >= 8.0, < 8.0.4, >= 7.0, < 7.43, >= 6.0, < 6.38 8.0.4, 7.43, 6.38
  18. Drupal Form API ignores access restrictions on submit buttons
    Alta · 7.5 CVE-2016-3165 >= 6.0, < 6.38 6.38
  19. Drupal saving user accounts can sometimes grant the user all roles
    Alta · 8.1 CVE-2016-3169 >= 6.0, < 6.38, >= 7.0, < 7.43 6.38, 7.43
  20. Drupal Brute force amplification attacks via XML-RPC
    Alta · 7.5 CVE-2016-3163 >= 7.0, < 7.43, >= 6.0, < 6.38 7.43, 6.38
  21. Drupal Open redirect vulnerability in the drupal_goto function
    Alta · 7.4 CVE-2016-3167 >= 6.0, < 6.38 6.38
  22. Drupal File upload access bypass and denial of service
    Alta · 8.1 CVE-2016-3162 >= 7.0, < 7.43, >= 8.0, < 8.0.4 7.43, 8.0.4
  23. Drupal arbitrary code execution
    Alta · 8.1 CVE-2016-3171 >= 6.0, < 6.38 6.38
  24. Drupal Saving user accounts can sometimes grant the user all roles
    Alta · 8.8 CVE-2016-6211 >= 7.0, < 7.44 7.44
  25. Drupal Incorrect cache context on password reset page
    Alta · 7.5 CVE-2016-9450 >= 8.0, < 8.2.3 8.2.3
  26. Drupal Cross-Site Request Forgery (CSRF)
    Alta · 7.5 CVE-2017-6379 >= 8.2.0, < 8.2.7 8.2.7
  27. Drupal Comment reply form allows access to restricted content
    Alta · 8.1 CVE-2017-6926 >= 8.4.0, < 8.4.5, >= 7.0, < 7.57 8.4.5, 7.57
  28. Drupal PECL YAML parser unsafe object handling
    Crítica · 9.8 CVE-2017-6920 >= 8.0, < 8.3.4 8.3.4
  29. Drupal access control bypass vulnerability
    Alta · 7.5 CVE-2017-6919 >= 8.0, < 8.2.8, >= 8.3.0, < 8.3.1 8.2.8, 8.3.1
  30. Drupal access bypass vulnerability
    Alta · 8.1 CVE-2017-6930 >= 8.4.0, < 8.4.5 8.4.5
  31. Drupal Entity access bypass for entities that do not have UUIDs or have protected revisions
    Crítica · 9.8 CVE-2017-6925 >= 8.0, < 8.3.7 8.3.7
  32. Drupal Remote code execution
    Alta · 8.1 CVE-2017-6381 >= 8.0, < 8.2.7 8.2.7
  33. Drupal editor module incorrectly checks access to inline private files
    Alta · 7.5 CVE-2017-6377 >= 8.2.0, < 8.2.7 8.2.7
  34. Drupal REST API can bypass comment approval
    Alta · 7.4 CVE-2017-6924 >= 8.0, < 8.3.7 8.3.7
  35. Drupal SQL Injection vulnerability
    Crítica · 9.8 CVE-2011-2715 = 6.20 sin corrección
  36. Drupal core - SA-CORE-2022-008
    Alta · 7.5 CVE-2022-25273 >= 8.0.0, < 9.2.18, >= 9.3.0, < 9.3.12 9.2.18, 9.3.12
  37. HTTP Proxy header vulnerability
    Alta · 8.1 CVE-2016-5385 >= 8.0, < 8.1.7 8.1.7
  38. guzzlehttp/psr7 <= 1.84 and 2.0.0-2.1.0 - Improper Input Validation
    Alta · 7.5 CVE-2022-24775 >= 8.0.0, < 9.2.16, >= 9.3.0, < 9.3.9 9.2.16, 9.3.9
  39. Drupal core - SA-CORE-2022-003
    Alta · 7.5 CVE-2022-25271 >= 8.0.0, < 9.2.13, >= 9.3.0, < 9.3.6 9.2.13, 9.3.6
  40. Drupal core - SA-CORE-2021-010
    Alta · 7.5 CVE-2020-13677 >= 8.0.0, < 8.9.19, >= 9.1.0, < 9.1.13, >= 9.2.0, < 9.2.6 8.9.19, 9.1.13, 9.2.6
  41. Drupal core - SA-CORE-2021-008
    Crítica · 9.8 CVE-2020-13675 >= 8.0.0, < 8.9.19, >= 9.1.0, < 9.1.13, >= 9.2.0, < 9.2.6 8.9.19, 9.1.13, 9.2.6
  42. Drupal core - SA-CORE-2021-006 esta entrada
    Sin evaluar CVE-2020-13673 >= 8.0.0, < 8.9.19, >= 9.1.0, < 9.1.13, >= 9.2.0, < 9.2.6 8.9.19, 9.1.13, 9.2.6
  43. Drupal core - SA-CORE-2021-004
    Alta · 7.1 CVE-2021-32610 >= 8.0.0, < 8.9.17, >= 9.1.0, < 9.1.11, >= 9.2.0, < 9.2.2 8.9.17, 9.1.11, 9.2.2
  44. Drupal core - SA-CORE-2020-013
    Alta · 7.8 CVE-2020-28948 >= 8.0.0, < 8.8.12, >= 8.9.0, < 8.9.10, >= 9.0.0, < 9.0.9 8.8.12, 8.9.10, 9.0.9
  45. Drupal core - SA-CORE-2020-012
    Alta · 8.8 Explotada en ataques CVE-2020-13671 >= 8.0.0, < 8.8.11, >= 8.9.0, < 8.9.9, >= 9.0.0, < 9.0.8 8.8.11, 8.9.9, 9.0.8
  46. Drupal core - SA-CORE-2020-011
    Alta · 7.5 CVE-2020-13670 >= 8.0.0, < 8.8.10, >= 8.9.0, < 8.9.6, >= 9.0.0, < 9.0.6 8.8.10, 8.9.6, 9.0.6
  47. Drupal core - SA-CORE-2020-006
    Crítica · 9.8 CVE-2020-13665 >= 8.0.0, < 8.8.8, >= 8.9.0, < 8.9.1, >= 9.0.0, < 9.0.1 8.8.8, 8.9.1, 9.0.1
  48. Drupal core - SA-CORE-2020-005
    Alta · 8.8 CVE-2020-13664 >= 8.0.0, < 8.8.8, >= 8.9.0, < 8.9.1, >= 9.0.0, < 9.0.1 8.8.8, 8.9.1, 9.0.1
  49. Drupal core - SA-CORE-2020-004
    Alta · 8.8 CVE-2020-13663 >= 8.0.0, < 8.8.8, >= 8.9.0, < 8.9.1, >= 9.0.0, < 9.0.1 8.8.8, 8.9.1, 9.0.1
  50. Drupal core - SA-CORE-2019-008
    Crítica · 9.8 CVE-2019-6342 >= 8.7.4, < 8.7.5 8.7.5
  51. Drupal core - SA-CORE-2019-007
    Crítica · 9.8 CVE-2019-11831 >= 8.0.0, < 8.6.16, >= 8.7.0, < 8.7.1 8.6.16, 8.7.1
  52. Drupal core - SA-CORE-2019-003
    Alta · 8.1 Explotada en ataques CVE-2019-6340 >= 8.0.0, < 8.5.11, >= 8.6.0, < 8.6.10 8.5.11, 8.6.10
  53. Drupal core - SA-CORE-2019-002
    Crítica · 9.8 CVE-2019-6339 >= 8.0.0, < 8.5.9, >= 8.6.0, < 8.6.6 8.5.9, 8.6.6
  54. Drupal core - SA-CORE-2019-001
    Alta · 8.0 CVE-2019-6338 >= 8.0.0, < 8.5.9, >= 8.6.0, < 8.6.6 8.5.9, 8.6.6
  55. Drupal Core Remote Code Execution Vulnerability
    Crítica · 9.8 Explotada en ataques CVE-2018-7602 >= 7.0, < 7.59, >= 8.0, < 8.4.8, >= 8.5, < 8.5.3 7.59, 8.4.8, 8.5.3
  56. Drupal Core Remote Code Execution Vulnerability
    Crítica · 9.8 Explotada en ataques CVE-2018-7600 >= 7.0, < 7.58, >= 8.0, < 8.3.9, >= 8.4.0, < 8.4.6, >= 8.5.0, < 8.5.1 7.58, 8.3.9, 8.4.6, 8.5.1

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.