| Vulnerability Name: | CVE-2018-7600 (CCN-140913) | ||||||||||||||||||||
| Assigned: | 2018-03-28 | ||||||||||||||||||||
| Published: | 2018-03-28 | ||||||||||||||||||||
| Updated: | 2019-03-01 | ||||||||||||||||||||
| Summary: | Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. | ||||||||||||||||||||
| CVSS v3 Severity: | 9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 9.1 Critical (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
9.1 Critical (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
| ||||||||||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||
| Vulnerability Type: | CWE-20 | ||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2018-7600 Source: CCN Type: IBM Security Bulletin 2015105 (API Connect) API Connect Developer Portal is affected by Drupal vulnerability (CVE-2018-7600) Source: BID Type: Third Party Advisory, VDB Entry 103534 Source: CCN Type: BID-103534 Drupal Core CVE-2018-7600 Multiple Remote Code Execution Vulnerabilities Source: SECTRACK Type: Third Party Advisory, VDB Entry 1040598 Source: MISC Type: Third Party Advisory https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/ Source: MISC Type: Third Party Advisory https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714 Source: XF Type: UNKNOWN drupal-cve20187600-code-exec(140913) Source: MISC Type: Third Party Advisory https://github.com/a2u/CVE-2018-7600 Source: MISC Type: Patch, Third Party Advisory https://github.com/g0rx/CVE-2018-7600-Drupal-RCE Source: MISC Type: Issue Tracking, Third Party Advisory https://greysec.net/showthread.php?tid=2912&pid=10561 Source: CONFIRM Type: Vendor Advisory https://groups.drupal.org/security/faq-2018-002 Source: MLIST Type: Third Party Advisory [debian-lts-announce] 20180328 [SECURITY] [DLA 1325-1] drupal7 security update Source: CCN Type: Packet Storm Security [04-13-2018] Drupal Drupalgeddon2 Remote Code Execution Source: CCN Type: Packet Storm Security [04-13-2018] Drupal Drupalgeddon2 Remote Code Execution Ruby Port Source: CCN Type: Packet Storm Security [04-17-2018] Drupalgeddon2 Drupal Remote Code Execution Source: CCN Type: Packet Storm Security [04-26-2018] Drupal Drupalgeddon 2 Forms API Property Injection Source: MISC Type: Exploit, Third Party Advisory https://research.checkpoint.com/uncovering-drupalgeddon-2/ Source: MISC Type: Third Party Advisory https://twitter.com/arancaytar/status/979090719003627521 Source: MISC Type: Third Party Advisory https://twitter.com/RicterZ/status/979567469726613504 Source: MISC Type: Third Party Advisory https://twitter.com/RicterZ/status/984495201354854401 Source: CCN Type: CYBERSECURITY & INFRASTRUCTURE SECURITY AGENCY KNOWN EXPLOITED VULNERABILITIES CATALOG Source: DEBIAN Type: Third Party Advisory DSA-4156 Source: CCN Type: SA-CORE-2018-002 Highly critical - Remote Code Execution Source: CONFIRM Type: Vendor Advisory https://www.drupal.org/sa-core-2018-002 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [04-13-2018] Source: EXPLOIT-DB Type: Exploit, Third Party Advisory, VDB Entry 44448 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [04-13-2018] Source: EXPLOIT-DB Type: Exploit, Third Party Advisory, VDB Entry 44449 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [04-17-2018] Source: EXPLOIT-DB Type: Exploit, Third Party Advisory, VDB Entry 44482 Source: CONFIRM Type: Third Party Advisory https://www.synology.com/support/security/Synology_SA_18_17 Source: MISC Type: Third Party Advisory https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know Source: CCN Type: WhiteSource Vulnerability Database CVE-2018-7600 | ||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||
| |||||||||||||||||||||
| BACK | |||||||||||||||||||||