Drupal includes an XML-RPC endpoint which is publicly available (xmlrpc.php). The PHP XML parser used by this XML-RPC endpoint was vulnerable to an XML entity expansion attack and other related XML payload attacks which could cause CPU and memory exhaustion and the site’s database to reach the maximum number of open connections. Any of these may lead to the site becoming unavailable or unresponsive (denial of service).
All Drupal sites were vulnerable to this attack whether XML-RPC is used or not.
Part of security release SA-CORE-2014-004
This vulnerability affects the following application versions:
- Drupal 5.0
- Drupal 5.1
- Drupal 5.2
- Drupal 5.3
- Drupal 5.4
- Drupal 5.5
- Drupal 5.6
- Drupal 5.7
- Drupal 5.8
- Drupal 5.9
- Drupal 5.10
- Drupal 5.11
- Drupal 5.12
- Drupal 5.13
- Drupal 5.14
- Drupal 5.15
- Drupal 5.16
- Drupal 5.17
- Drupal 5.18
- Drupal 5.19
- Drupal 5.20
- Drupal 5.21
- Drupal 5.22
- Drupal 5.23
- Drupal 6.0
- Drupal 6.1
- Drupal 6.2
- Drupal 6.3
- Drupal 6.4
- Drupal 6.5
- Drupal 6.6
- Drupal 6.7
- Drupal 6.8
- Drupal 6.9
- Drupal 6.10
- Drupal 6.11
- Drupal 6.12
- Drupal 6.13
- Drupal 6.14
- Drupal 6.15
- Drupal 6.16
- Drupal 6.17
- Drupal 6.18
- Drupal 6.19
- Drupal 6.20
- Drupal 6.21
- Drupal 6.22
- Drupal 6.23
- Drupal 6.24
- Drupal 6.25
- Drupal 6.26
- Drupal 6.27
- Drupal 6.28
- Drupal 6.29
- Drupal 6.30
- Drupal 6.31
- Drupal 6.32
- Drupal 7.0
- Drupal 7.1
- Drupal 7.2
- Drupal 7.3
- Drupal 7.4
- Drupal 7.5
- Drupal 7.6
- Drupal 7.7
- Drupal 7.8
- Drupal 7.9
- Drupal 7.10
- Drupal 7.11
- Drupal 7.12
- Drupal 7.13
- Drupal 7.14
- Drupal 7.15
- Drupal 7.16
- Drupal 7.17
- Drupal 7.18
- Drupal 7.19
- Drupal 7.20
- Drupal 7.21
- Drupal 7.22
- Drupal 7.23
- Drupal 7.24
- Drupal 7.25
- Drupal 7.26
- Drupal 7.27
- Drupal 7.28
- Drupal 7.29
- Drupal 7.30