CVE-2018-7602

CRITICALCVSS 9.8Known Exploited

CISA Known Exploited Vulnerability

https://nvd.nist.gov/vuln/detail/CVE-2018-7602

Remediation deadline: May 4, 2022

Ransomware use: Known

Description

A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.

Timeline

Published:July 19th, 2018 5:29 PM

Last modified:August 13th, 2026 5:17 AM

Added to KEV:April 13th, 2022

CVSS Scoring

CVSS v3: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2: 7.5

Affected Software

From NVD CPE configuration data

Vendors

drupaldebian

Products

drupaldebian_linux

Weaknesses (CWE)

CWE-94

References & Reports

Advisories, patches, and third-party reports

http://www.securityfocus.com/bid/103985Broken Link
http://www.securitytracker.com/id/1040754Broken Link
https://lists.debian.org/debian-lts-announce/2018/04/msg00030.htmlMailing List
https://www.debian.org/security/2018/dsa-4180Third Party Advisory
https://www.drupal.org/sa-core-2018-004Patch
https://www.exploit-db.com/exploits/44542/Exploit
https://www.exploit-db.com/exploits/44557/Exploit
http://www.securityfocus.com/bid/103985Broken Link
http://www.securitytracker.com/id/1040754Broken Link
https://lists.debian.org/debian-lts-announce/2018/04/msg00030.htmlMailing List
https://www.debian.org/security/2018/dsa-4180Third Party Advisory
https://www.drupal.org/sa-core-2018-004Patch
https://www.exploit-db.com/exploits/44542/Exploit
https://www.exploit-db.com/exploits/44557/Exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602US Government Resource

Source: NIST NVD · Data may lag official sources by up to one minute