The Security advisories does not mention the usual classification for how critical this is (probably because it is about 3rd-party libraries). Can the whole site be compromised with this vulnerability or is it about accessing restricted content?




  • 2
    In the Drupal security email about it, it was described as moderately critical.
    – Andy
    Aug 2, 2018 at 8:45
  • 1
    Also "moderately critical" in their PSA: drupal.org/psa-2018-07-30
    – MattLBeck
    Aug 2, 2018 at 15:21

2 Answers 2


The specific vulnerability seems to be the ability of a requester to send one request path to the webserver, but use an HTTP header to make Drupal see a different path.

The rewrite happens early, so the access layer in Drupal/Symfony runs as intended. But it bypasses path-based restrictions that happen earlier ("on higher level caches and web servers", according to the CVE at https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers).

For example, if you use .htaccess to restrict /admin/* from outside your IP range, that might be bypassed, but Drupal's own access system will still work as it should.


At https://www.cybersecurity-help.cz/vdb/SB2018080118?affChecked=1 this vulnerability is described as low-risk. I haven't been able to find anything that describes in any detail how it can be exploited, though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.