{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Drupal versions 6.x ant\u00e9rieures \u00e0 6.10.",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    },
    {
      "description": "Drupal versions 5.x ant\u00e9rieures \u00e0 5.16 ;",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans le traitement des th\u00e8mes de\nDrupal. Cette faille permet d\u0027inclure des fichiers d\u00e9j\u00e0 pr\u00e9sents sur le\nserveur, ce qui peut conduire \u00e0 une ex\u00e9cution de code arbitraire \u00e0\ndistance.\n\nCette vuln\u00e9rabilit\u00e9 n\u0027est exploitable que sous Microsoft Windows.\n\n## Solution\n\nSe r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2009-03-03T00:00:00",
  "last_revision_date": "2009-03-03T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SA-CORE-2009-003 (versions 6.x) du 25    f\u00e9vrier 2009 :",
      "url": "http://drupal.org/node/383724"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SA-CORE-2009-004 (versions 5.x) du 25    f\u00e9vrier 2009 :",
      "url": "http://drupal.org/node/384024"
    }
  ],
  "reference": "CERTA-2009-AVI-080",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2009-03-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans \u003cspan class=\"textit\"\u003eDrupal\u003c/span\u003e permet\nd\u0027acc\u00e9der en lecture \u00e0 des fichiers et, dans certains cas, de les\nex\u00e9cuter.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Drupal",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 SA-CORE-2009-003 et SA-CORE-2009-004 du 25 f\u00e9vrier 2009",
      "url": null
    }
  ]
}