Slashdot Mirror
Update Drupal ASAP: Over a Million Sites Can Be Easily Hacked by Any Visitor (zdnet.com)
Developers of popular open-source CMS Drupal are warning admins to immediately patch a flaw that an attacker can exploit just by visiting a vulnerable site. From a report: The bug affects all sites running on Drupal 8, Drupal 7, and Drupal 6. Drupal's project usage page indicates that about a million sites are running the affected versions. Admins are being urged to immediately update to Drupal 7.58 or Drupal 8.5.1. Drupal issued an alert for the patch last week warning admins to allocate time for patching because exploits might arrive "within hours or days" of its security release. So far, there haven't been any attacks using the flaw, according to Drupal. The bug, which is being called Drupalgeddon2, has been assigned the official identifier CVE-2018-7600. Drupal has given it a 'highly critical' rating with a risk score of 21 out of 25 under the NIST Common Misuse Scoring System. Further reading: Drupal Fixes Drupalgeddon2 Security Flaw That Allows Hackers to Take Over Sites (BleepingComputer). Commenting on security advisory that Drupal issued last week, BleepingComputer's Catalin Cimpanu said, "In the 9 years I've been around Drupal, I've never seen them publish such an apocalyptic security advisory."
https://www.drupal.org/sa-core...
Saves time clicking through the articles.
Drupal 6 and 5 are EOL, but still get patches due to the severity of the issue:
For Drupal 6: https://www.drupal.org/files/issues/2018-03-28/SA-CORE-2018-002.patch
For Drupal 5: https://www.drupal.org/files/issues/2018-03-28/sa-core-2018-002-d5.patch
From the Drupal 6 Long Term Support here: https://www.drupal.org/project/d6lts/issues/2955130