CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability

Critical severity · published Mar 29, 2018

CVE-2018-7600

Drupal Core Remote Code Execution Vulnerability

RansomwareIn wildKEV

9.8

CVSS

100%

EPSS

Yes

On KEV

Description

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)100.0% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed Nov 3, 2021

Federal remediation dueMay 3, 2022

Ransomware campaign useKnown

Affected products

Which versions

Drupal · Drupal

through 7.57; 8.0.0 before 8.3.9; 8.4.0 before 8.4.6; 8.5.0 before 8.5.1 · source: NVD, KEV

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 ·

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 · source: vendor

Debian Linux · Debian

7.0; 8.0; 9.0 · source: NVD

Affected product

Drupal

All Drupal CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2018-7600

CVE.org

https://www.cve.org/CVERecord?id=CVE-2018-7600

CISA KEV catalogue

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

x_refsource_MISC

https://github.com/g0rx/CVE-2018-7600-Drupal-RCE

vdb-entry

http://www.securitytracker.com/id/1040598

x_refsource_MISC

https://twitter.com/arancaytar/status/979090719003627521

x_refsource_MISC

https://twitter.com/RicterZ/status/979567469726613504

x_refsource_CONFIRM

https://www.drupal.org/sa-core-2018-002

x_refsource_CONFIRM

https://www.synology.com/support/security/Synology_SA_18_17