CVE-2018-7600criticalunder attackransomwareCWE-20

CVE-2018-7600: critical vulnerability in Drupal before 7.58, 8.x before 8.3.9, 8.4.x…

Published · Updated

Follow this CVE+ Monitor Drupal core+ Monitor before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon1 day
Published on NVDMar 29
1st PoC+1d
metasploitMar 28
CISA KEV+1315d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

Drupal versions before 7.58, 8.3.9, 8.4.6, and 8.5.1 contain a critical vulnerability that allows attackers to run malicious code on affected websites. This happens because multiple core systems don't properly validate certain inputs when using default or common configurations.

Technical detail

A remote attacker can execute arbitrary code in vulnerable Drupal installations through improper input validation in multiple subsystems. The vulnerability affects default and commonly-used module configurations without requiring authentication. Successful exploitation leads to complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1
public PoCs found — 120✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/44448exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/44449exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/44482githubgithub.com/dreadlocked/Drupalgeddon2★ 600githubgithub.com/a2u/CVE-2018-7600★ 353githubgithub.com/pimps/CVE-2018-7600★ 141githubgithub.com/g0rx/CVE-2018-7600-Drupal-RCE★ 113githubgithub.com/firefart/CVE-2018-7600★ 71githubgithub.com/lorddemon/drupalgeddon2★ 11githubgithub.com/r3dxpl0it/CVE-2018-7600★ 9githubgithub.com/rabbitmask/CVE-2018-7600-Drupal7★ 8githubgithub.com/zhzyker/CVE-2018-7600-Drupal-POC-EXP★ 8githubgithub.com/dr-iman/CVE-2018-7600-Drupal-0day-RCE★ 7githubgithub.com/thehappydinoa/CVE-2018-7600★ 7githubgithub.com/jirojo2/drupalgeddon2★ 5githubgithub.com/ludy-dev/drupal8-REST-RCE★ 4githubgithub.com/sl4cky/CVE-2018-7600★ 4githubgithub.com/dwisiswant0/CVE-2018-7600★ 4githubgithub.com/shellord/CVE-2018-7600-Drupal-RCE★ 4githubgithub.com/sl4cky/CVE-2018-7600-Masschecker★ 3githubgithub.com/knqyf263/CVE-2018-7600★ 3githubgithub.com/Hestat/drupal-check★ 2githubgithub.com/elkhaoudari/CVE-2018-7600-PoC★ 2githubgithub.com/4l13n-DN/POC-CVE-2018-7600★ 1githubgithub.com/ynsmroztas/drupalhunter★ 1githubgithub.com/muhammedkayag/CVE-2018-7600★ 1githubgithub.com/shellord/Drupalgeddon-Mass-Exploiter★ 1githubgithub.com/Meraj1312/cve-2018-7600-drupalgeddon2-lab★ 1githubgithub.com/Prapul1/VulnHub-DC1-Writeup★ 1githubgithub.com/Damian972/drupalgeddon-2★ 1githubgithub.com/drugeddon/drupal-exploit★ 1githubgithub.com/0xAJ2K/CVE-2018-7600★ 1githubgithub.com/erman-bolukbasi/web-penetration-drupal★ 0githubgithub.com/r0lh/CVE-2018-7600★ 0githubgithub.com/raytran54/CVE-2018-7600★ 0githubgithub.com/rafaelcaria/drupalgeddon2-CVE-2018-7600★ 0githubgithub.com/MoriartyPuth-Labs/DC1-Lab★ 0githubgithub.com/Dowonkwon/drupal-cve-2018-7600-poc★ 0githubgithub.com/Alexnpc18/Drupalgeddon2-python★ 0githubgithub.com/Shams-Ul-Mehmood/CVE-2018-7600-Drupalgeddon2-RCE★ 0githubgithub.com/RB4C/drupalgeddon2-CVE-2018-7600★ 0githubgithub.com/anldori/CVE-2018-7600★ 0githubgithub.com/vphnguyen/ANM_CVE-2018-7600★ 0githubgithub.com/tpdlshdmlrkfmcla/CVE-2018-7600.★ 0githubgithub.com/nika0x38/CVE-2018-7600★ 0githubgithub.com/SanCody/DC1-Penetration-Testing-Report★ 0githubgithub.com/Vaibhav91one/drupalgeddon2-cve-lab★ 0githubgithub.com/rajaabdullahnasir/CVE-2018-7600-Remote-Code-Execution★ 0githubgithub.com/xxxTectationxxx/CVE-2018-7600★ 0githubgithub.com/ruthvikvegunta/Drupalgeddon2★ 0githubgithub.com/K52-ai/CVE-2018-7600★ 0githubgithub.com/CyberCTF/vulhub-drupal-cve-2018-7600★ 0githubgithub.com/soch4n/CVE-2018-7600★ 0githubgithub.com/happynote3966/CVE-2018-7600★ 0githubgithub.com/cved-sources/cve-2018-7600★ 0githubgithub.com/madneal/codeql-scanner★ 0githubgithub.com/M-Abid34/CVE-2018-7600★ 0githubgithub.com/SyedGhufranRaza/CVE-2018-7600-Remote-Code-Execution★ 0githubgithub.com/tea-celikik/Drupal-Exploit-Lab★ 0githubgithub.com/bixiPRO/Drupalgeddon2-CVE-2018-7600★ 0githubgithub.com/Dungsocool/CVE-2018-7600★ 0githubgithub.com/nayem-m/drupalgeddon2-cli★ 0githubgithub.com/Aihikk/DC-1_Vulnhub_Walkthrough★ 0vulncheckvulncheck.com/xdb/4699ae4dcab1unverifiedvulncheckvulncheck.com/xdb/e5040e1a4b4eunverifiedvulncheckvulncheck.com/xdb/3d1688d5ab25unverifiedvulncheckvulncheck.com/xdb/4fd5c25b6975unverifiedvulncheckvulncheck.com/xdb/15a6ea88eaf7unverifiedvulncheckvulncheck.com/xdb/b46f747a0508unverifiedvulncheckvulncheck.com/xdb/ddf40e5b5eb7unverifiedvulncheckvulncheck.com/xdb/6210c8efb8c0unverifiedvulncheckvulncheck.com/xdb/e6cf9763451bunverifiedvulncheckvulncheck.com/xdb/d4d58bdc2983unverifiedvulncheckvulncheck.com/xdb/14773d4e222dunverifiedvulncheckvulncheck.com/xdb/8b41ab8606feunverifiedvulncheckvulncheck.com/xdb/1a86bf155206unverifiedvulncheckvulncheck.com/xdb/23aaab43fcd7unverifiedvulncheckvulncheck.com/xdb/85edc13d35baunverifiedvulncheckvulncheck.com/xdb/9b3b4008c550unverifiedvulncheckvulncheck.com/xdb/607015e36d80unverifiedvulncheckvulncheck.com/xdb/ca334bf953fcunverifiedvulncheckvulncheck.com/xdb/1fd919acd85eunverifiedvulncheckvulncheck.com/xdb/e07a02c6c680unverifiedvulncheckvulncheck.com/xdb/8fd9c335c455unverifiedcve_referencewww.exploit-db.com/exploits/44449/unverifiedvulncheckvulncheck.com/xdb/18441ff73017unverifiedvulncheckvulncheck.com/xdb/e104ec642cd7unverifiedvulncheckvulncheck.com/xdb/2ecaf3d373e2unverifiedvulncheckvulncheck.com/xdb/fe354a439c20unverifiedvulncheckvulncheck.com/xdb/49097e1fdbbbunverifiedvulncheckvulncheck.com/xdb/6f85920c0670unverifiedcve_referencewww.exploit-db.com/exploits/44448/unverifiedvulncheckvulncheck.com/xdb/4aec43da11eaunverifiedcve_referencewww.exploit-db.com/exploits/44482/unverifiedvulncheckvulncheck.com/xdb/ccc6bd53fd2bunverifiedvulncheckvulncheck.com/xdb/464985de7dedunverifiedvulncheckvulncheck.com/xdb/2cb73a6f32d0unverifiedvulncheckvulncheck.com/xdb/36d1b1902163unverifiedvulncheckvulncheck.com/xdb/275e04b88ebeunverifiedvulncheckvulncheck.com/xdb/1df8d0e011f7unverifiedvulncheckvulncheck.com/xdb/d1a4b59d693cunverifiedvulncheckvulncheck.com/xdb/62fa544a97dcunverifiedvulncheckvulncheck.com/xdb/020a6d58ef57unverifiedvulncheckvulncheck.com/xdb/b2ad4ba89de6unverifiedvulncheckvulncheck.com/xdb/06e3c416c2d9unverifiedvulncheckvulncheck.com/xdb/9b1b9ea4c421unverifiedvulncheckvulncheck.com/xdb/e00c4f0f2628unverifiedvulncheckvulncheck.com/xdb/c878141c1b57unverifiedvulncheckvulncheck.com/xdb/70444c690e44unverifiedvulncheckvulncheck.com/xdb/c7637bac32d5unverifiedvulncheckvulncheck.com/xdb/a91d4aaab05cunverifiedvulncheckvulncheck.com/xdb/2c29ea901266unverifiedvulncheckvulncheck.com/xdb/8bb18d909af8unverifiedvulncheckvulncheck.com/xdb/0f9b4b5c3fddunverifiedvulncheckvulncheck.com/xdb/f6840124d312unverifiedvulncheckvulncheck.com/xdb/53767629a229unverifiedvulncheckvulncheck.com/xdb/4649e1e3eb49unverifiedvulncheckvulncheck.com/xdb/0bef2689fa42unverifiedvulncheckvulncheck.com/xdb/d1958c41a3f7unverifiedvulncheckvulncheck.com/xdb/2cf109ac0290unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.