CVE-2018-7600criticalsob ataqueransomwareCWE-20

CVE-2018-7600: falha crítica em Drupal before 7.58, 8.x before 8.3.9, 8.4.x…

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Drupal core+ Monitorar before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

100Vexday Risk Score

Corrija agora. Ela está sob exploração confirmada pelo CISA e tem exploit funcional público.

ssvc Actcvss 9.8epss 100%
da publicação à arma1 dia
Publicada no NVD29 de mar.
1ª PoC+1d
metasploit28 de mar.
CISA KEV+1315d
O que os fabricantes declaram (VEX)

Declarações oficiais dos fabricantes em formato CSAF/VEX: se o produto deles está afetado, já corrigido ou descartado — e por quê. É afirmação do fabricante, não juízo do Vexday.

Red Hatdocumento VEX ↗
Não afetado
1 produto — porque o código vulnerável não está presente no produto
red_hat_products
Ação exigida pela CISAprazo federal: 2022-05-03

Apply updates per vendor instructions.

Versões

Afetadas
composer/drupal/core >= 7.0, < 7.58; composer/drupal/core >= 8.0, < 8.3.9; composer/drupal/core >= 8.4.0, < 8.4.6; composer/drupal/core >= 8.5.0, < 8.5.1; composer/drupal/drupal >= 7.0, < 7.58; composer/drupal/drupal >= 8.0, < 8.3.9
Corrigidas em
composer/drupal/core 7.58; composer/drupal/core 8.3.9; composer/drupal/core 8.4.6; composer/drupal/core 8.5.1; composer/drupal/drupal 7.58; composer/drupal/drupal 8.3.9
Pesquisado e redigido com IA a partir do advisory do fornecedor e de análises públicas, com as fontes acima. Confira sempre a versão corrigida no advisory oficial antes de agir.
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
n/a · Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1
PoCs públicas encontradas — 119✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/44448exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/44449exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/44482githubgithub.com/dreadlocked/Drupalgeddon2★ 600githubgithub.com/a2u/CVE-2018-7600★ 353githubgithub.com/pimps/CVE-2018-7600★ 141githubgithub.com/g0rx/CVE-2018-7600-Drupal-RCE★ 113githubgithub.com/firefart/CVE-2018-7600★ 71githubgithub.com/lorddemon/drupalgeddon2★ 11githubgithub.com/r3dxpl0it/CVE-2018-7600★ 9githubgithub.com/zhzyker/CVE-2018-7600-Drupal-POC-EXP★ 8githubgithub.com/rabbitmask/CVE-2018-7600-Drupal7★ 8githubgithub.com/dr-iman/CVE-2018-7600-Drupal-0day-RCE★ 7githubgithub.com/thehappydinoa/CVE-2018-7600★ 7githubgithub.com/jirojo2/drupalgeddon2★ 5githubgithub.com/sl4cky/CVE-2018-7600★ 4githubgithub.com/shellord/CVE-2018-7600-Drupal-RCE★ 4githubgithub.com/dwisiswant0/CVE-2018-7600★ 4githubgithub.com/ludy-dev/drupal8-REST-RCE★ 4githubgithub.com/knqyf263/CVE-2018-7600★ 3githubgithub.com/sl4cky/CVE-2018-7600-Masschecker★ 3githubgithub.com/elkhaoudari/CVE-2018-7600-PoC★ 2githubgithub.com/Hestat/drupal-check★ 2githubgithub.com/Meraj1312/cve-2018-7600-drupalgeddon2-lab★ 1githubgithub.com/Prapul1/VulnHub-DC1-Writeup★ 1githubgithub.com/ynsmroztas/drupalhunter★ 1githubgithub.com/Damian972/drupalgeddon-2★ 1githubgithub.com/0xAJ2K/CVE-2018-7600★ 1githubgithub.com/4l13n-DN/POC-CVE-2018-7600★ 1githubgithub.com/shellord/Drupalgeddon-Mass-Exploiter★ 1githubgithub.com/muhammedkayag/CVE-2018-7600★ 1githubgithub.com/drugeddon/drupal-exploit★ 1githubgithub.com/MoriartyPuth-Labs/DC1-Lab★ 0githubgithub.com/soch4n/CVE-2018-7600★ 0githubgithub.com/r0lh/CVE-2018-7600★ 0githubgithub.com/raytran54/CVE-2018-7600★ 0githubgithub.com/rafaelcaria/drupalgeddon2-CVE-2018-7600★ 0githubgithub.com/Dowonkwon/drupal-cve-2018-7600-poc★ 0githubgithub.com/Alexnpc18/Drupalgeddon2-python★ 0githubgithub.com/Shams-Ul-Mehmood/CVE-2018-7600-Drupalgeddon2-RCE★ 0githubgithub.com/RB4C/drupalgeddon2-CVE-2018-7600★ 0githubgithub.com/anldori/CVE-2018-7600★ 0githubgithub.com/vphnguyen/ANM_CVE-2018-7600★ 0githubgithub.com/tpdlshdmlrkfmcla/CVE-2018-7600.★ 0githubgithub.com/nika0x38/CVE-2018-7600★ 0githubgithub.com/SanCody/DC1-Penetration-Testing-Report★ 0githubgithub.com/happynote3966/CVE-2018-7600★ 0githubgithub.com/cved-sources/cve-2018-7600★ 0githubgithub.com/Vaibhav91one/drupalgeddon2-cve-lab★ 0githubgithub.com/rajaabdullahnasir/CVE-2018-7600-Remote-Code-Execution★ 0githubgithub.com/xxxTectationxxx/CVE-2018-7600★ 0githubgithub.com/SyedGhufranRaza/CVE-2018-7600-Remote-Code-Execution★ 0githubgithub.com/tea-celikik/Drupal-Exploit-Lab★ 0githubgithub.com/ruthvikvegunta/Drupalgeddon2★ 0githubgithub.com/madneal/codeql-scanner★ 0githubgithub.com/M-Abid34/CVE-2018-7600★ 0githubgithub.com/bixiPRO/Drupalgeddon2-CVE-2018-7600★ 0githubgithub.com/erman-bolukbasi/web-penetration-drupal★ 0githubgithub.com/Dungsocool/CVE-2018-7600★ 0githubgithub.com/nayem-m/drupalgeddon2-cli★ 0githubgithub.com/Aihikk/DC-1_Vulnhub_Walkthrough★ 0githubgithub.com/K52-ai/CVE-2018-7600★ 0githubgithub.com/CyberCTF/vulhub-drupal-cve-2018-7600★ 0vulncheckvulncheck.com/xdb/d1958c41a3f7não verificadovulncheckvulncheck.com/xdb/2cf109ac0290não verificadovulncheckvulncheck.com/xdb/4699ae4dcab1não verificadovulncheckvulncheck.com/xdb/e5040e1a4b4enão verificadovulncheckvulncheck.com/xdb/3d1688d5ab25não verificadovulncheckvulncheck.com/xdb/4fd5c25b6975não verificadovulncheckvulncheck.com/xdb/15a6ea88eaf7não verificadovulncheckvulncheck.com/xdb/b46f747a0508não verificadovulncheckvulncheck.com/xdb/ddf40e5b5eb7não verificadovulncheckvulncheck.com/xdb/85edc13d35banão verificadovulncheckvulncheck.com/xdb/e07a02c6c680não verificadovulncheckvulncheck.com/xdb/2cb73a6f32d0não verificadovulncheckvulncheck.com/xdb/36d1b1902163não verificadovulncheckvulncheck.com/xdb/275e04b88ebenão verificadovulncheckvulncheck.com/xdb/d4d58bdc2983não verificadovulncheckvulncheck.com/xdb/ca334bf953fcnão verificadovulncheckvulncheck.com/xdb/8fd9c335c455não verificadovulncheckvulncheck.com/xdb/14773d4e222dnão verificadovulncheckvulncheck.com/xdb/23aaab43fcd7não verificadovulncheckvulncheck.com/xdb/18441ff73017não verificadovulncheckvulncheck.com/xdb/9b3b4008c550não verificadovulncheckvulncheck.com/xdb/607015e36d80não verificadocve_referencewww.exploit-db.com/exploits/44482/não verificadocve_referencewww.exploit-db.com/exploits/44449/não verificadovulncheckvulncheck.com/xdb/8b41ab8606fenão verificadovulncheckvulncheck.com/xdb/e104ec642cd7não verificadocve_referencewww.exploit-db.com/exploits/44448/não verificadovulncheckvulncheck.com/xdb/1fd919acd85enão verificadovulncheckvulncheck.com/xdb/fe354a439c20não verificadovulncheckvulncheck.com/xdb/1a86bf155206não verificadovulncheckvulncheck.com/xdb/49097e1fdbbbnão verificadovulncheckvulncheck.com/xdb/6f85920c0670não verificadovulncheckvulncheck.com/xdb/2ecaf3d373e2não verificadovulncheckvulncheck.com/xdb/ccc6bd53fd2bnão verificadovulncheckvulncheck.com/xdb/464985de7dednão verificadovulncheckvulncheck.com/xdb/e6cf9763451bnão verificadovulncheckvulncheck.com/xdb/6210c8efb8c0não verificadovulncheckvulncheck.com/xdb/1df8d0e011f7não verificadovulncheckvulncheck.com/xdb/d1a4b59d693cnão verificadovulncheckvulncheck.com/xdb/62fa544a97dcnão verificadovulncheckvulncheck.com/xdb/020a6d58ef57não verificadovulncheckvulncheck.com/xdb/b2ad4ba89de6não verificadovulncheckvulncheck.com/xdb/06e3c416c2d9não verificadovulncheckvulncheck.com/xdb/9b1b9ea4c421não verificadovulncheckvulncheck.com/xdb/e00c4f0f2628não verificadovulncheckvulncheck.com/xdb/c878141c1b57não verificadovulncheckvulncheck.com/xdb/70444c690e44não verificadovulncheckvulncheck.com/xdb/c7637bac32d5não verificadovulncheckvulncheck.com/xdb/a91d4aaab05cnão verificadovulncheckvulncheck.com/xdb/2c29ea901266não verificadovulncheckvulncheck.com/xdb/8bb18d909af8não verificadovulncheckvulncheck.com/xdb/0f9b4b5c3fddnão verificadovulncheckvulncheck.com/xdb/f6840124d312não verificadovulncheckvulncheck.com/xdb/53767629a229não verificadovulncheckvulncheck.com/xdb/4649e1e3eb49não verificadovulncheckvulncheck.com/xdb/0bef2689fa42não verificado
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.