vulnwire
8.1high

CVE-2018-7602KEV · ransomwarein critical feed2 exploitsNuclei template

Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

Also known as DRUPAL-CORE-2018-004, GHSA-297x-j9pm-xjgg

Published 8 y ago · modified 35 d ago · JSON

CVSS
8.1
v3.1 · CNA
CISA KEV
Yes
added 2022-04-13
EPSS
99.2%
percentile 100%
Public exploits
2
Exploit-DB · Nuclei check

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

Known exploited (CISA KEV)

Added
4 y ago
Due date
2022-05-04 (4 y ago)
Ransomware use
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor / product
Drupal / Core
CISA name
Drupal Core Remote Code Execution Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction (EPSS)

99.17% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • Nuclei template Drupal - Remote Code Execution · nuclei detection template
  • EDB-44557 Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit) · webapps · 2018-04-30
  • EDB-44542 Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC) · webapps · 2018-04-25

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.18.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.18.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

Affected packages

EcosystemPackageAffectedFixed in
packagistdrupal/core
>=7.0, <7.59
>=8.0, <8.4.8
>=8.5, <8.5.3
>=8.0.0, <8.4.8
>=8.5.0, <8.5.3
7.59
8.4.8
8.5.3
packagistdrupal/drupal
>=7.0, <7.59
>=8.0, <8.4.8
>=8.5, <8.5.3
7.59
8.4.8
8.5.3

Affected products

  • Drupal core

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

  • exploit-db.com /exploits/44557/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • securitytracker.com /id/1040754 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • lists.debian.org /debian-lts-announce/2018/04/msg00030.html · mailing-list, x_refsource_MLIST, x_transferred
  • exploit-db.com /exploits/44542/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • debian.org /security/2018/dsa-4180 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • drupal.org /sa-core-2018-004 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/103985 · vdb-entry, x_refsource_BID, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602 · government-resource
  • nvd.nist.gov /vuln/detail/CVE-2018-7602 · advisory
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7602.yaml · web
  • github.com /FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7602.yaml · web
  • github.com /drupal/core · package
  • exploit-db.com /exploits/44542 · web
  • exploit-db.com /exploits/44557 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.