SecOraLens
CriticalCVE

Drupal warns of critical Commerce Core flaw exploited in attacks

BleepingComputer·Source published ·1 min read

What happened?

Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild. [...]

Key details

  • Commerce Core is used by over 42,000 websites including Fortune 500 companies and research universities.
  • The advisory is tagged as highly critical and was released on a Wednesday.
  • CISA has previously flagged five Drupal vulnerabilities exploited in the wild, two abused by ransomware gangs.

Affected

  • Commerce Core versions 0.0.0 through 2.41 and 3.0.0 through 3.3.13 are affected.

Fixes and mitigations

  1. Upgrade to Commerce Core 3.3.13 for the 3.x branch or Commerce Core 8.x-2.41 for earlier versions.

Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories