CVE-2018-7602
Fixed in a distro release ExploitedEPSS 99%CVSS 8.1
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
Products: Drupal core
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | drupal/core | 8.4.8 |
| Packagist | drupal/core | 8.5.3 |
| Packagist | drupal/core | 7.59 |
| Packagist | drupal/drupal | 7.59 |
| Packagist | drupal/drupal | 8.4.8 |
| Packagist | drupal/drupal | 8.5.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | drupal | 8.5.3-1 |
| Debian 7 | drupal7 | 7.14-2+deb7u19 |
| Debian 8 | drupal7 | 7.32-1+deb8u12 |
| Debian 9 | drupal7 | 7.52-2+deb9u4 |
| Ubuntu Pro 14.04 LTS | drupal7 | 7.26-1ubuntu0.1+esm1 |
| Ubuntu Pro 16.04 LTS | drupal7 | 7.44-1ubuntu1~16.04.0+esm1 |