CVE-2018-7600 Drupal Core Remote Code Execution Vulnerability
CriticalCVSS 9.8
EPSS 100.0%
CISA KEV
added 2021-11-03 · due 2022-05-03
Ransomware
Exploited in the wild
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
CISA Known Exploited Vulnerability
- Date added
- 2021-11-03
- Due date (FCEB)
- 2022-05-03
- Ransomware use
- Known
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal/core(Packagist) | >= 8.0.0, < 8.3.9 | 8.3.9 |
| drupal/core(Packagist) | >= 8.4.0, < 8.4.6 | 8.4.6 |
| drupal/core(Packagist) | >= 8.5.0, < 8.5.1 | 8.5.1 |
| drupal/core(Packagist) | = 8.0.0 | No fix listed |
| drupal/core(Packagist) | = 8.0.1 | No fix listed |
| drupal/core(Packagist) | = 8.0.2 | No fix listed |
| drupal/core(Packagist) | = 8.0.3 | No fix listed |
| drupal/core(Packagist) | = 8.0.4 | No fix listed |
| drupal/core(Packagist) | = 8.0.5 | No fix listed |
| drupal/core(Packagist) | = 8.0.6 | No fix listed |
| drupal/core(Packagist) | = 8.1.0 | No fix listed |
| drupal/core(Packagist) | = 8.1.0-beta1 | No fix listed |
| drupal/core(Packagist) | = 8.1.0-beta2 | No fix listed |
| drupal/core(Packagist) | = 8.1.0-rc1 | No fix listed |
| drupal/core(Packagist) | = 8.1.1 | No fix listed |
| drupal/core(Packagist) | = 8.1.10 | No fix listed |
| drupal/core(Packagist) | = 8.1.2 | No fix listed |
| drupal/core(Packagist) | = 8.1.3 | No fix listed |
| drupal/core(Packagist) | = 8.1.4 | No fix listed |
| drupal/core(Packagist) | = 8.1.5 | No fix listed |
| drupal/core(Packagist) | = 8.1.6 | No fix listed |
| drupal/core(Packagist) | = 8.1.7 | No fix listed |
| drupal/core(Packagist) | = 8.1.8 | No fix listed |
| drupal/core(Packagist) | = 8.1.9 | No fix listed |
| drupal/core(Packagist) | = 8.2.0 | No fix listed |
Show 159 more
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal/core(Packagist) | = 8.2.0-beta1 | No fix listed |
| drupal/core(Packagist) | = 8.2.0-beta2 | No fix listed |
| drupal/core(Packagist) | = 8.2.0-beta3 | No fix listed |
| drupal/core(Packagist) | = 8.2.0-rc1 | No fix listed |
| drupal/core(Packagist) | = 8.2.0-rc2 | No fix listed |
| drupal/core(Packagist) | = 8.2.1 | No fix listed |
| drupal/core(Packagist) | = 8.2.2 | No fix listed |
| drupal/core(Packagist) | = 8.2.3 | No fix listed |
| drupal/core(Packagist) | = 8.2.4 | No fix listed |
| drupal/core(Packagist) | = 8.2.5 | No fix listed |
| drupal/core(Packagist) | = 8.2.6 | No fix listed |
| drupal/core(Packagist) | = 8.2.7 | No fix listed |
| drupal/core(Packagist) | = 8.2.8 | No fix listed |
| drupal/core(Packagist) | = 8.3.0 | No fix listed |
| drupal/core(Packagist) | = 8.3.0-alpha1 | No fix listed |
| drupal/core(Packagist) | = 8.3.0-beta1 | No fix listed |
| drupal/core(Packagist) | = 8.3.0-rc1 | No fix listed |
| drupal/core(Packagist) | = 8.3.0-rc2 | No fix listed |
| drupal/core(Packagist) | = 8.3.1 | No fix listed |
| drupal/core(Packagist) | = 8.3.2 | No fix listed |
| drupal/core(Packagist) | = 8.3.3 | No fix listed |
| drupal/core(Packagist) | = 8.3.4 | No fix listed |
| drupal/core(Packagist) | = 8.3.5 | No fix listed |
| drupal/core(Packagist) | = 8.3.6 | No fix listed |
| drupal/core(Packagist) | = 8.3.7 | No fix listed |
| drupal/core(Packagist) | = 8.3.8 | No fix listed |
| drupal/core(Packagist) | = 8.4.0 | No fix listed |
| drupal/core(Packagist) | = 8.4.1 | No fix listed |
| drupal/core(Packagist) | = 8.4.2 | No fix listed |
| drupal/core(Packagist) | = 8.4.3 | No fix listed |
| drupal/core(Packagist) | = 8.4.4 | No fix listed |
| drupal/core(Packagist) | = 8.4.5 | No fix listed |
| drupal/core(Packagist) | = 8.5.0 | No fix listed |
| drupal/core(Packagist) | >= 7.0, < 7.58 | 7.58 |
| drupal/core(Packagist) | >= 8.0, < 8.3.9 | 8.3.9 |
| drupal/core(Packagist) | = 8.0.0-beta10 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta11 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta12 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta13 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta14 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta15 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta16 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta6 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta7 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta8 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta9 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc1 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc2 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc3 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc4 | No fix listed |
| drupal/drupal(Packagist) | >= 7.0, < 7.58 | 7.58 |
| drupal/drupal(Packagist) | >= 8.0, < 8.3.9 | 8.3.9 |
| drupal/drupal(Packagist) | = 8.0.0 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-alpha14 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-alpha15 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta1 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta10 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta11 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta12 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta13 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta14 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta15 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta16 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta2 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta3 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta4 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta5 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta6 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta7 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta9 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-rc1 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-rc2 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-rc3 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-rc4 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.1 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.2 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.3 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.4 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.5 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.6 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.0 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.0-beta1 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.0-beta2 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.0-rc1 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.1 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.10 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.2 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.3 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.4 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.5 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.6 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.7 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.8 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.9 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.0 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.0-beta1 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.0-beta2 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.0-beta3 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.0-rc1 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.0-rc2 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.1 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.2 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.3 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.4 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.5 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.6 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.7 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.8 | No fix listed |
| drupal/drupal(Packagist) | = 8.3.0 | No fix listed |
| drupal/drupal(Packagist) | = 8.3.0-alpha1 | No fix listed |
| drupal/drupal(Packagist) | = 8.3.0-beta1 | No fix listed |
| drupal/drupal(Packagist) | = 8.3.0-rc1 | No fix listed |
| drupal/drupal(Packagist) | = 8.3.0-rc2 | No fix listed |
| drupal/drupal(Packagist) | = 8.3.1 | No fix listed |
| drupal/drupal(Packagist) | = 8.3.2 | No fix listed |
| drupal/drupal(Packagist) | = 8.3.3 | No fix listed |
| drupal/drupal(Packagist) | = 8.3.4 | No fix listed |
| drupal/drupal(Packagist) | = 8.3.5 | No fix listed |
| drupal/drupal(Packagist) | = 8.3.6 | No fix listed |
| drupal/drupal(Packagist) | = 8.3.7 | No fix listed |
| drupal/drupal(Packagist) | = 8.3.8 | No fix listed |
| drupal/drupal(Packagist) | >= 8.4, < 8.4.6 | 8.4.6 |
| drupal/drupal(Packagist) | = 8.4.0 | No fix listed |
| drupal/drupal(Packagist) | = 8.4.0-alpha1 | No fix listed |
| drupal/drupal(Packagist) | = 8.4.0-beta1 | No fix listed |
| drupal/drupal(Packagist) | = 8.4.0-rc1 | No fix listed |
| drupal/drupal(Packagist) | = 8.4.0-rc2 | No fix listed |
| drupal/drupal(Packagist) | = 8.4.1 | No fix listed |
| drupal/drupal(Packagist) | = 8.4.2 | No fix listed |
| drupal/drupal(Packagist) | = 8.4.3 | No fix listed |
| drupal/drupal(Packagist) | = 8.4.4 | No fix listed |
| drupal/drupal(Packagist) | = 8.4.5 | No fix listed |
| drupal/drupal(Packagist) | >= 8.5, < 8.5.1 | 8.5.1 |
| drupal/drupal(Packagist) | = 8.5.0 | No fix listed |
| drupal/drupal(Packagist) | = 8.5.0-alpha1 | No fix listed |
| drupal/drupal(Packagist) | = 8.5.0-beta1 | No fix listed |
| drupal/drupal(Packagist) | = 8.5.0-rc1 | No fix listed |
| drupal/drupal | <= 7.57 | No fix listed |
| drupal/drupal | >= 8.0.0, < 8.3.9 | 8.3.9 |
| drupal/drupal | >= 8.4.0, < 8.4.6 | 8.4.6 |
| drupal/drupal | >= 8.5.0, < 8.5.1 | 8.5.1 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| alpine/drupal7(Alpine:v3.10) | < 7.58-r0 | 7.58-r0 |
| alpine/drupal7(Alpine:v3.11) | < 7.58-r0 | 7.58-r0 |
| alpine/drupal7(Alpine:v3.12) | < 7.58-r0 | 7.58-r0 |
| alpine/drupal7(Alpine:v3.13) | < 7.58-r0 | 7.58-r0 |
| alpine/drupal7(Alpine:v3.14) | < 7.58-r0 | 7.58-r0 |
| alpine/drupal7(Alpine:v3.15) | < 7.58-r0 | 7.58-r0 |
| alpine/drupal7(Alpine:v3.16) | < 7.58-r0 | 7.58-r0 |
| alpine/drupal7(Alpine:v3.17) | < 7.58-r0 | 7.58-r0 |
| alpine/drupal7(Alpine:v3.18) | < 7.58-r0 | 7.58-r0 |
| alpine/drupal7(Alpine:v3.19) | < 7.58-r0 | 7.58-r0 |
| alpine/drupal7(Alpine:v3.20) | < 7.58-r0 | 7.58-r0 |
| alpine/drupal7(Alpine:v3.6) | < 7.58-r0 | 7.58-r0 |
| alpine/drupal7(Alpine:v3.7) | < 7.58-r0 | 7.58-r0 |
| alpine/drupal7(Alpine:v3.8) | < 7.58-r0 | 7.58-r0 |
| alpine/drupal7(Alpine:v3.9) | < 7.58-r0 | 7.58-r0 |
References
- www.drupal.org vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- www.tenable.com third-party-advisory
- www.synology.com third-party-advisory
- 44482 exploit third-party-advisory vdb-entry
- 44449 exploit third-party-advisory vdb-entry
- 44448 exploit third-party-advisory vdb-entry
- DSA-4156 third-party-advisory vendor-advisory
- www.cisa.gov government-resource us-government-resource
- twitter.com third-party-advisory
- twitter.com broken-link third-party-advisory
- twitter.com broken-link third-party-advisory
- research.checkpoint.com exploit third-party-advisory
- [debian-lts-announce] 20180328 [SECURITY] [DLA 1325-1] drupal7 security update mailing-list third-party-advisory
- groups.drupal.org vendor-advisory
- greysec.net broken-link issue-tracking third-party-advisory
- github.com exploit patch third-party-advisory
- github.com product
- github.com exploit third-party-advisory
- github.com exploit
- github.com exploit
- blog.appsecco.com third-party-advisory
- badpackets.net broken-link third-party-advisory
- 103534 broken-link third-party-advisory vdb-entry
- 1040598 broken-link third-party-advisory vdb-entry
- github.com
- security.alpinelinux.org vendor-advisory