CVE-2018-7600
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1
Published 29 Mar 2018 · updated 17 Jun 2026 · Analyzed
9.8 Critical · CVSS 3.1, NVD
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, with a remediation deadline of 3 May 2022 for US federal agencies. It has been used in ransomware campaigns.
Required action: Apply updates per vendor instructions.
Description
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
References
- www.securityfocus.com/bid/103534 · Broken Link, Third Party Advisory, VDB Entry
- www.securitytracker.com/id/1040598 · Broken Link, Third Party Advisory, VDB Entry
- badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/ · Broken Link, Third Party Advisory
- blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714 · Third Party Advisory
- github.com/a2u/CVE-2018-7600 · Third Party Advisory
- github.com/g0rx/CVE-2018-7600-Drupal-RCE · Patch, Third Party Advisory
- greysec.net/showthread.php?tid=2912&pid=10561 · Broken Link, Issue Tracking, Third Party Advisory
- groups.drupal.org/security/faq-2018-002 · Vendor Advisory
- lists.debian.org/debian-lts-announce/2018/03/msg00028.html · Third Party Advisory
- research.checkpoint.com/uncovering-drupalgeddon-2/ · Exploit, Third Party Advisory
- twitter.com/RicterZ/status/979567469726613504 · Broken Link, Third Party Advisory
- twitter.com/RicterZ/status/984495201354854401 · Broken Link, Third Party Advisory
- twitter.com/arancaytar/status/979090719003627521 · Third Party Advisory
- www.debian.org/security/2018/dsa-4156 · Third Party Advisory
- www.drupal.org/sa-core-2018-002 · Vendor Advisory
- www.exploit-db.com/exploits/44448/ · Exploit, Third Party Advisory, VDB Entry
- www.exploit-db.com/exploits/44449/ · Exploit, Third Party Advisory, VDB Entry
- www.exploit-db.com/exploits/44482/ · Exploit, Third Party Advisory, VDB Entry
- www.synology.com/support/security/Synology_SA_18_17 · Third Party Advisory
- www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know · Third Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600 · US Government Resource