Vulnerability Description
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Drupal | Drupal | <= 7.57 |
| Debian | Debian Linux | 7.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/103534Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040598Broken LinkThird Party AdvisoryVDB Entry
- https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-Broken LinkThird Party Advisory
- https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-00Third Party Advisory
- https://github.com/a2u/CVE-2018-7600Third Party Advisory
- https://github.com/g0rx/CVE-2018-7600-Drupal-RCEPatchThird Party Advisory
- https://greysec.net/showthread.php?tid=2912&pid=10561Broken LinkIssue TrackingThird Party Advisory
- https://groups.drupal.org/security/faq-2018-002Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/03/msg00028.htmlThird Party Advisory
- https://research.checkpoint.com/uncovering-drupalgeddon-2/ExploitThird Party Advisory
- https://twitter.com/RicterZ/status/979567469726613504Broken LinkThird Party Advisory
- https://twitter.com/RicterZ/status/984495201354854401Broken LinkThird Party Advisory
- https://twitter.com/arancaytar/status/979090719003627521Third Party Advisory
- https://www.debian.org/security/2018/dsa-4156Third Party Advisory
- https://www.drupal.org/sa-core-2018-002Vendor Advisory
FAQ
What is CVE-2018-7600?
CVE-2018-7600 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or com...
How severe is CVE-2018-7600?
CVE-2018-7600 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-7600?
Check the references section above for vendor advisories and patch information. Affected products include: Drupal Drupal, Debian Debian Linux.