Log in Start free

Actively exploited · Published Jul 19, 2018 · Assigned by drupal

CVE-2018-7602Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

High 8.1 Exploited Ransomware

In plain English

A high-severity code injection in core from Drupal. Attackers are actively exploiting it in the wild (listed by CISA on April 13, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 99.2% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)99.2%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Apr 13, 2022
Attack tooling2Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 4, 2022.

Official description

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20drupal77.59-r0ALPINE-CVE-2018-7602
Packagistdrupal/core7.59GHSA-297x-j9pm-xjgg
Packagistdrupal/core8.4.8GHSA-297x-j9pm-xjgg
Packagistdrupal/core8.5.3GHSA-297x-j9pm-xjgg
Packagistdrupal/core8.4.8, 8.5.3DRUPAL-CORE-2018-004
Packagistdrupal/drupal8.4.8GHSA-297x-j9pm-xjgg
Packagistdrupal/drupal8.5.3GHSA-297x-j9pm-xjgg
Packagistdrupal/drupal7.59GHSA-297x-j9pm-xjgg

Affected products (as reported)

VendorProductVersions
Drupal core unspecified – before 7.59unspecified – before 8.5.3unspecified – before 8.4.8

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References