Drupal · Core
CVE-2018-7602
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
What it is
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
CISA: A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 4, 2022
- Added to the CISA list
- April 13, 2022
- Published
- July 19, 2018
- Severity
- High 8.1 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.2% in the top 0.1% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (7)
- https://www.debian.org/security/2018/dsa-4180
- https://www.exploit-db.com/exploits/44557/
- http://www.securitytracker.com/id/1040754
- https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html
- https://www.exploit-db.com/exploits/44542/
- https://www.drupal.org/sa-core-2018-004
- http://www.securityfocus.com/bid/103985
More exploited flaws from Drupal
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 22, 2026 | SQL Injection | Core | Critical 9.8 | 89% |
| Mar 25, 2022 | Remote Code Execution | Core | High 8.1 | 92% |
| Jan 18, 2022 | core Un-restricted Upload of File | Drupal core | High 8.8 | 36% |
| Nov 3, 2021 | Core Remote Code Execution | Drupal Core | Critical 9.8 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.