CVE-2018-7602highunder attackransomwareCWE-94

CVE-2018-7602: high-severity vulnerability in Drupal core

Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

Published · Updated

Follow this CVE+ Monitor Drupal core+ Monitor drupal/core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.1epss 99%
from disclosure to weaponsame day
Published on NVDJul 19
1st PoCApr 17
CISA KEV+1364d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
Action required by CISAfederal deadline: 2022-05-04

Apply updates per vendor instructions.

In short

Drupal websites have a critical flaw that lets attackers run malicious code remotely, taking over the entire site. This vulnerability is actively being exploited by criminals.

Technical detail

A remote code execution vulnerability exists in Drupal 7.x and 8.x core through multiple subsystems, allowing unauthenticated or low-privileged attackers to execute arbitrary code via crafted requests. The vulnerability is related to inadequate input validation and sanitization in core functionality, resulting in complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Drupal · core
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.