Drupal core’s multisite feature dynamically determines which configuration file to use based on the HTTP Host header. The HTTP Host header validation does not sufficiently check maliciously-crafted header values. An attacker could cause Drupal to include and execute specifically named files outside of its root directory.
Part of security release SA-CORE-2014-003
This vulnerability affects the following application versions:
- Drupal 5.0
- Drupal 5.1
- Drupal 5.2
- Drupal 5.3
- Drupal 5.4
- Drupal 5.5
- Drupal 5.6
- Drupal 5.7
- Drupal 5.8
- Drupal 5.9
- Drupal 5.10
- Drupal 5.11
- Drupal 5.12
- Drupal 6.0
- Drupal 6.1
- Drupal 6.2
- Drupal 6.3
- Drupal 6.4
- Drupal 6.5
- Drupal 6.6