TROYANOSYVIRUS
Back to CVEs

CVE-2018-7600

CRITICALCISA KEV
9.8

Description

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

CVE Details

CVSS v3.1 Score9.8
SeverityCRITICAL
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
Published3/29/2018
Last Modified10/31/2025
Sourcekev
Honeypot Sightings0

CISA KEV

VendorDrupal
ProductDrupal Core
Vulnerability NameDrupal Core Remote Code Execution Vulnerability
KEV Date Added2021-11-03
Remediation Due Date2022-05-03
Ransomware UseKnown

Affected Products

debian:debian_linuxdrupal:drupal

Weaknesses (CWE)

CWE-20CWE-20

References

http://www.securityfocus.com/bid/103534(af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1040598(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/a2u/CVE-2018-7600(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/g0rx/CVE-2018-7600-Drupal-RCE(af854a3a-2127-422b-91ae-364da2661108)
https://greysec.net/showthread.php?tid=2912&pid=10561(af854a3a-2127-422b-91ae-364da2661108)
https://groups.drupal.org/security/faq-2018-002(af854a3a-2127-422b-91ae-364da2661108)
https://twitter.com/RicterZ/status/979567469726613504(af854a3a-2127-422b-91ae-364da2661108)
https://twitter.com/RicterZ/status/984495201354854401(af854a3a-2127-422b-91ae-364da2661108)
https://twitter.com/arancaytar/status/979090719003627521(af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2018/dsa-4156(af854a3a-2127-422b-91ae-364da2661108)
https://www.drupal.org/sa-core-2018-002(af854a3a-2127-422b-91ae-364da2661108)
https://www.exploit-db.com/exploits/44448/(af854a3a-2127-422b-91ae-364da2661108)
https://www.exploit-db.com/exploits/44449/(af854a3a-2127-422b-91ae-364da2661108)
https://www.exploit-db.com/exploits/44482/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.