CVE-2018-7602

Drupal core

Published 19 Jul 2018 · updated 2 Oct 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 13 Apr 2022, with a remediation deadline of 4 May 2022 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

References

www.securityfocus.com/bid/103985 · Broken Link, Third Party Advisory, VDB Entry
www.securitytracker.com/id/1040754 · Broken Link, Third Party Advisory, VDB Entry
lists.debian.org/debian-lts-announce/2018/04/msg00030.html · Mailing List, Third Party Advisory
www.debian.org/security/2018/dsa-4180 · Third Party Advisory
www.drupal.org/sa-core-2018-004 · Patch, Vendor Advisory
www.exploit-db.com/exploits/44542/ · Exploit, Third Party Advisory, VDB Entry
www.exploit-db.com/exploits/44557/ · Exploit, Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602 · US Government Resource