| Vulnerability Name: | CVE-2018-7602 (CCN-142366) | ||||||||||||||||||||
| Assigned: | 2018-04-25 | ||||||||||||||||||||
| Published: | 2018-04-25 | ||||||||||||||||||||
| Updated: | 2021-04-20 | ||||||||||||||||||||
| Summary: | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild. | ||||||||||||||||||||
| CVSS v3 Severity: | 9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 9.1 Critical (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
9.1 Critical (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
| ||||||||||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||
| Vulnerability Type: | CWE-noinfo | ||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2018-7602 Source: CCN Type: IBM Security Bulletin 2015829 (API Connect) API Connect Developer Portal is affected by a Drupal vulnerability (CVE-2018-7602) Source: BID Type: Third Party Advisory, VDB Entry 103985 Source: CCN Type: BID-103985 Drupal Core CVE-2018-7602 Remote Code Execution Vulnerability Source: SECTRACK Type: Third Party Advisory, VDB Entry 1040754 Source: XF Type: UNKNOWN drupal-cve20187602-code-exec(142366) Source: MLIST Type: Mailing List, Third Party Advisory [debian-lts-announce] 20180426 [SECURITY] [DLA 1365-1] drupal7 security update Source: CCN Type: Packet Storm Security [04-26-2018] Drupal drupgeddon3 Remote Code Execution Source: CCN Type: Packet Storm Security [04-30-2018] Drupalgeddon3 Remote Code Execution Source: DEBIAN Type: Third Party Advisory DSA-4180 Source: CCN Type: SA-CORE-2018-004 Drupal core - Critical - Remote Code Execution Source: CONFIRM Type: Patch, Vendor Advisory https://www.drupal.org/sa-core-2018-004 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [04-25-2018] Source: EXPLOIT-DB Type: Exploit, Third Party Advisory, VDB Entry 44542 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [04-30-2018] Source: EXPLOIT-DB Type: Exploit, Third Party Advisory, VDB Entry 44557 | ||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||
| |||||||||||||||||||||
| BACK | |||||||||||||||||||||