← CVE Radar
CVE-2018-7602Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
9.8 CRITICALEPSS 99.17%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 8.1 | HIGH | 3.1CISA-ADP | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 7.5 | HIGH | 2.0NVD | AV:N/AC:L/Au:N/C:P/I:P/A:P |
CISA required action
⚡ Known exploited · remediation due May 4, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2018-7602
- Status
- Analyzed
- Assigner (CNA)
- drupal
- Published
- Jul 19, 2018
- Last modified
- 2026-10-02 14:54 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
Drupalcore3 version ranges
- before 7.59
- before 8.5.3
- before 8.4.8
References
- securityfocus.com http://www.securityfocus.com/bid/103985
- securitytracker.com http://www.securitytracker.com/id/1040754
- lists.debian.org https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html
- debian.org https://www.debian.org/security/2018/dsa-4180
- drupal.org https://www.drupal.org/sa-core-2018-004
- exploit-db.com https://www.exploit-db.com/exploits/44542/
- exploit-db.com https://www.exploit-db.com/exploits/44557/
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602