GitHub Advisoryadvisory · Packagist

GHSA-297x-j9pm-xjgg Drupal Core Remote Code Execution Vulnerability

CRITICAL Published 2024-04-23 Modified 2025-10-22 Official page ↗
Aliases
CVE-2018-7602
Ecosystem
Packagist
Packages
drupal/core, drupal/drupal
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weaknesses
CWE-94
Reviewed
2024-04-23

Affected packages

• Packagist drupal/core: >= 7.0, < 7.59 → fixed in 7.59 • Packagist drupal/core: >= 8.0, < 8.4.8 → fixed in 8.4.8 • Packagist drupal/core: >= 8.5, < 8.5.3 → fixed in 8.5.3 • Packagist drupal/drupal: >= 7.0, < 7.59 → fixed in 7.59 • Packagist drupal/drupal: >= 8.0, < 8.4.8 → fixed in 8.4.8 • Packagist drupal/drupal: >= 8.5, < 8.5.3 → fixed in 8.5.3

Description

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

Related

Alias · CVE (1)

  • CVE-2018-7602 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References