CVE-2018-7602
Drupal Core: Remote Code Execution
As of , CVE-2018-7602 in Drupal Core is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.
- Exploited
- Yes: CISA listed it on 13 April 2022
- US federal deadline
- 4 May 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Known
- EPSS score
- 0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- EPSS when listed
- 0.74 on 13 April 2022EPSS on the day CISA listed it.
- Public exploit
- 2 Exploit-DB entries (2 verified)
- Fix
- No vendor link in CISA's entry
What CISA says to do
Apply updates per vendor instructions.
CISA's required action
What the flaw is
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
CISA's description
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
The CVE record's description, from drupal
- CVE published
- 19 July 2018
- Assigned by
- drupal
- CVSS
- 8.1 High (CVSS 3.1, from CISA-ADP)
- CWE-94
- Improper Control of Generation of Code ('Code Injection')
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- no
- CISA SSVC, technical impact
- total
Timeline
- Exploit-DB published an exploit (EDB-ID 44542).
- Exploit-DB published an exploit (EDB-ID 44557).
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Public exploits
Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.
- Exploit-DB: Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit)EDB-ID 44557, verified by Exploit-DB, 30 April 2018
- Exploit-DB: Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC)EDB-ID 44542, verified by Exploit-DB, 25 April 2018
Core: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2019-6340Remote Code Execution | Drupal Core | Patch this weekMetasploit module; EPSS 0.92; verified Exploit-DB entry | 0.92 | ||
| CVE-2026-9082SQL Injection | Drupal Core | Patch this weekMetasploit module | 0.16 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org