CVE-2018-7600

critical-risk
Published 2018-03-29

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Do I need to act?

!
94.5% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
3 public exploits available
44482, 44449, 44448
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (4)

Affected Vendors

Debian Drupal

References (41)

Broken Link http://www.securityfocus.com/bid/103534
Broken Link http://www.securitytracker.com/id/1040598
Broken Link https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-...
Third Party Advisory https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-00...
Third Party Advisory https://github.com/a2u/CVE-2018-7600
Patch https://github.com/g0rx/CVE-2018-7600-Drupal-RCE
Broken Link https://greysec.net/showthread.php?tid=2912&pid=10561
Vendor Advisory https://groups.drupal.org/security/faq-2018-002
Third Party Advisory https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html
Exploit https://research.checkpoint.com/uncovering-drupalgeddon-2/
Broken Link https://twitter.com/RicterZ/status/979567469726613504
Broken Link https://twitter.com/RicterZ/status/984495201354854401
Third Party Advisory https://twitter.com/arancaytar/status/979090719003627521
Third Party Advisory https://www.debian.org/security/2018/dsa-4156
Vendor Advisory https://www.drupal.org/sa-core-2018-002
Exploit https://www.exploit-db.com/exploits/44448/
Exploit https://www.exploit-db.com/exploits/44449/
Exploit https://www.exploit-db.com/exploits/44482/
Third Party Advisory https://www.synology.com/support/security/Synology_SA_18_17
Third Party Advisory https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to...
and 21 more references
Get this data via API
curl -H "Authorization: Bearer YOUR_KEY" \
  https://cyber.phasetransitions.ai/api/v1/cves/CVE-2018-7600
Free tier: 100 requests/day, no credit card.
76
/ 100
critical-risk
Severity 32/34 · Critical
Exploitability 34/34 · Critical
Exposure 10/34 · Low