In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details
CVSS Details
- CVSS 3.1 Base Score: 8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade drupal7 | Jan 22, 2019 | Jan 17, 2019 |
| Drupal | — | Upgrade to drupal version 8.6.6Upgrade to drupal version 8.5.9Upgrade to drupal version 7.62 | Mar 29, 2019 | Jan 22, 2019 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jan 22, 2019 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub