CVE-2014-3704: Debian Linux

High severity, CVSS 7.5. EPSS: 100% chance of exploitation in the next 30 days.

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.

Affected products

• Debian Debian Linux: version 7.0 only
• Drupal Drupal: from 7.0, before 7.32 (fixed in 7.32)

Published 2014-10-16. Last modified 2026-06-17.