CVEvulnerability
CVE-2018-7600
CISA Known Exploited Vulnerability
Drupal Core Remote Code Execution Vulnerability — Drupal Drupal Core
Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.
- Added to KEV
- 2021-11-03
- Remediation due
- 2022-05-03
- Ransomware use
- Known
- Required action
- Apply updates per vendor instructions.
- Notes
- https://nvd.nist.gov/vuln/detail/CVE-2018-7600
- Status
- Analyzed
- Published
- 2018-03-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-20
Description
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
Affected configurations
• drupal drupal (<= 7.57)
• drupal drupal (>= 8.0.0 < 8.3.9)
• drupal drupal (>= 8.4.0 < 8.4.6)
• drupal drupal (>= 8.5.0 < 8.5.1)
• debian debian linux 7.0
• debian debian linux 8.0
• debian debian linux 9.0
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://www.securityfocus.com/bid/103534 Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040598 Broken Link, Third Party Advisory, VDB Entry
- https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/ Broken Link, Third Party Advisory
- https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714 Third Party Advisory
- https://github.com/a2u/CVE-2018-7600 Third Party Advisory
- https://github.com/g0rx/CVE-2018-7600-Drupal-RCE Patch, Third Party Advisory
- https://greysec.net/showthread.php?tid=2912&pid=10561 Broken Link, Issue Tracking, Third Party Advisory
- https://groups.drupal.org/security/faq-2018-002 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html Third Party Advisory
- https://research.checkpoint.com/uncovering-drupalgeddon-2/ Exploit, Third Party Advisory
- https://twitter.com/RicterZ/status/979567469726613504 Broken Link, Third Party Advisory
- https://twitter.com/RicterZ/status/984495201354854401 Broken Link, Third Party Advisory
- https://twitter.com/arancaytar/status/979090719003627521 Third Party Advisory
- https://www.debian.org/security/2018/dsa-4156 Third Party Advisory
- https://www.drupal.org/sa-core-2018-002 Vendor Advisory
- https://www.exploit-db.com/exploits/44448/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/44449/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/44482/ Exploit, Third Party Advisory, VDB Entry
- https://www.synology.com/support/security/Synology_SA_18_17 Third Party Advisory
- https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know Third Party Advisory
- http://www.securityfocus.com/bid/103534 Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040598 Broken Link, Third Party Advisory, VDB Entry
- https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/ Broken Link, Third Party Advisory
- https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714 Third Party Advisory
- https://github.com/a2u/CVE-2018-7600 Third Party Advisory
- https://github.com/g0rx/CVE-2018-7600-Drupal-RCE Patch, Third Party Advisory
- https://greysec.net/showthread.php?tid=2912&pid=10561 Broken Link, Issue Tracking, Third Party Advisory
- https://groups.drupal.org/security/faq-2018-002 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html Third Party Advisory
- https://research.checkpoint.com/uncovering-drupalgeddon-2/ Exploit, Third Party Advisory
- https://twitter.com/RicterZ/status/979567469726613504 Broken Link, Third Party Advisory
- https://twitter.com/RicterZ/status/984495201354854401 Broken Link, Third Party Advisory
- https://twitter.com/arancaytar/status/979090719003627521 Third Party Advisory
- https://www.debian.org/security/2018/dsa-4156 Third Party Advisory
- https://www.drupal.org/sa-core-2018-002 Vendor Advisory
- https://www.exploit-db.com/exploits/44448/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/44449/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/44482/ Exploit, Third Party Advisory, VDB Entry
- https://www.synology.com/support/security/Synology_SA_18_17 Third Party Advisory
- https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600 US Government Resource