# MA-838.062022: MyCERT Advisory - Drupal Releases Security Updates

**Date:** 08 Jun 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-838.062022  
**Advisory ID:** MA-838.062022

---

**1.0 Introduction**
Drupal is a popular content management system that is free and open source. Drupal has released security updates to address a vulnerability that does not affect Drupal core but may affect some contributed projects or custom code on Drupal sites.
**2.0 Impact**
Exploitation of this vulnerability could allow a remote attacker to take control of an affected website.
**3.0 Affected Products**
• Drupal 9.3.x versions prior to 9.3.14
• Drupal 9.2.x versions prior to 9.2.20
All versions of Drupal 9 prior to 9.2.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life. Drupal 7 is not affected.
**4.0 Recommendations**
MyCERT encourages users and administrators are recommended to do necessary updates by following either of these instructions below:
<https://www.drupal.org/sa-core-2022-010>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1) <https://www.cisa.gov/uscert/ncas/current-activity/2022/05/26/drupal-releases-security-updates>
2) <https://www.drupal.org/sa-core-2022-010>