CVE-2018-7602
CriticalActively exploited (CISA KEV)Known to be used in ransomware campaigns
Description
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Drupal Core
PublishedJul 19, 2018
First seenJul 19, 2018
Added to KEVApr 13, 2022
Weakness typeCWE-94Code injection
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: May 4, 2022Update
- drupal drupal7.59, 8.4.8, 8.5.3 or later
- drupal/core8.4.8, 8.5.3, 7.59 or later
- drupal/drupal7.59, 8.4.8, 8.5.3 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal drupal | 7.0 ≤ v < 7.59, 8.4.0 ≤ v < 8.4.8, 8.5.0 ≤ v < 8.5.3 | 7.59, 8.4.8, 8.5.3 |
| debian debian_linux | 7.0, 8.0, 9.0 | — |
| drupal/corePackagist | 8.0.0 ≤ v < 8.4.8, 8.5.0 ≤ v < 8.5.3, 7.0 ≤ v < 7.59, 8.0 ≤ v < 8.4.8, 8.5 ≤ v < 8.5.3 | 8.4.8, 8.5.3, 7.59 |
| drupal/drupalPackagist | 7.0 ≤ v < 7.59, 8.0 ≤ v < 8.4.8, 8.5 ≤ v < 8.5.3 | 7.59, 8.4.8, 8.5.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.