Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component This article explores framework acknowledged vulnerability. . "The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor."
The open-source content-management framework acknowledged that the vulnerability is being "actively exploited in the wild," but provided no specifics about the nature of the activity or the extent of the campaign.
Users are being recommended to update to the latest version
- Version 3.x
- Upgrade to Commerce Core 3.3.13 Drupal has credited researchers Dan Puccetti (dpuccetti), Marcus Johansson (marcus_johansson), and Robert Snyder (rsnyd) with reporting the flaw. The other category refers to "PHP2Shell-branded tools unrelated to the vulnerabilities that instead relied on session poisoning and a separate local file inclusion (LFI) vulnerability in the application," Wiz researchers Yaara Shriki, Shahar Dorfman, Alma Blachsan, and Yaron Samuel said.
