CVE-2014-3704
Published: 16 October 2014
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
drupal6 Launchpad, Ubuntu, Debian |
lucid |
Not vulnerable
|
| precise |
Not vulnerable
|
|
| trusty |
Does not exist
|
|
| upstream |
Not vulnerable
|
|
|
drupal7 Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
| precise |
Released
(7.12-1ubuntu0.1)
|
|
| trusty |
Released
(7.26-1ubuntu0.1)
|
|
| upstream |
Released
(7.32-1)
|