GitHub Advisoryadvisory · Packagist
GHSA-7fh9-933g-885p Drupal Core Remote Code Execution Vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2018-7600
- Ecosystem
- Packagist
- Packages
- drupal/core, drupal/drupal
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
- Weaknesses
- CWE-20
- Reviewed
- 2024-04-23
Affected packages
• Packagist drupal/core: >= 7.0, < 7.58 → fixed in 7.58
• Packagist drupal/core: >= 8.0, < 8.3.9 → fixed in 8.3.9
• Packagist drupal/core: >= 8.4.0, < 8.4.6 → fixed in 8.4.6
• Packagist drupal/core: >= 8.5.0, < 8.5.1 → fixed in 8.5.1
• Packagist drupal/drupal: >= 7.0, < 7.58 → fixed in 7.58
• Packagist drupal/drupal: >= 8.0, < 8.3.9 → fixed in 8.3.9
• Packagist drupal/drupal: >= 8.4, < 8.4.6 → fixed in 8.4.6
• Packagist drupal/drupal: >= 8.5, < 8.5.1 → fixed in 8.5.1
Description
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
Related
Alias · CVE (1)
- CVE-2018-7600 Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-7600 advisory
- https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know web
- https://www.synology.com/support/security/Synology_SA_18_17 web
- https://www.exploit-db.com/exploits/44482 web
- https://www.exploit-db.com/exploits/44449 web
- https://www.exploit-db.com/exploits/44448 web
- https://www.drupal.org/sa-core-2018-002 web
- https://www.debian.org/security/2018/dsa-4156 web
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600 web
- https://twitter.com/arancaytar/status/979090719003627521 web
- https://twitter.com/RicterZ/status/984495201354854401 web
- https://twitter.com/RicterZ/status/979567469726613504 web
- https://research.checkpoint.com/uncovering-drupalgeddon-2 web
- https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html web
- https://groups.drupal.org/security/faq-2018-002 web
- https://greysec.net/showthread.php?tid=2912&pid=10561 web
- https://github.com/g0rx/CVE-2018-7600-Drupal-RCE web
- https://github.com/drupal/core package
- https://github.com/a2u/CVE-2018-7600 web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7600.yaml web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7600.yaml web
- https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714 web
- https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600 web
- http://www.securityfocus.com/bid/103534 web
- http://www.securitytracker.com/id/1040598 web