CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability

EPSS trend

Probability

99.99%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 99.99% on 18-09-2026

18-09-202618-10-2026

EPSS score

99.99%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 03-11-2021
Federal due date: 03-05-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2018-7600

Public exploits

5 found

referenceUnverified
Exploit Reference (research.checkpoint.com)
Maturity: unknown
exploit-databaseremotephpVerified
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)
Maturity: weaponized
exploit-databasephpVerified
Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution
Maturity: poc

Show all 5 exploits

exploit-databasephpVerified
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC)
Maturity: poc
MetasploitremoteVerified
Drupal Drupalgeddon 2 Forms API Property Injection
exploit/unix/webapp/drupal_drupalgeddon2
Maturity: weaponized

References

26 links

github.com/g0rx/CVE-2018-7600-Drupal-RCEX Refsource MISCPatchThird Party Advisory
www.securitytracker.com/id/1040598VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
twitter.com/arancaytar/status/979090719003627521X Refsource MISCThird Party Advisory
twitter.com/RicterZ/status/979567469726613504X Refsource MISCBroken LinkThird Party Advisory
www.drupal.org/sa-core-2018-002X Refsource CONFIRMVendor AdvisoryREPORT
www.synology.com/support/security/Synology_SA_18_17X Refsource CONFIRMThird Party Advisory
github.com/a2u/CVE-2018-7600X Refsource MISCThird Party Advisory
www.exploit-db.com/exploits/44482/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
research.checkpoint.com/uncovering-drupalgeddon-2/X Refsource MISCExploitThird Party Advisory
groups.drupal.org/security/faq-2018-002X Refsource CONFIRMVendor AdvisoryREPORT

Show all 26 references

www.debian.org/security/2018/dsa-4156Vendor AdvisoryX Refsource DEBIANThird Party Advisory
lists.debian.org/debian-lts-announce/2018/03/msg00028.htmlMailing ListX Refsource MLISTThird Party Advisory
www.exploit-db.com/exploits/44448/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.securityfocus.com/bid/103534VDB EntryX Refsource BIDBroken LinkThird Party Advisory
badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/X Refsource MISCBroken LinkThird Party Advisory
greysec.net/showthread.php?tid=2912&pid=10561X Refsource MISCBroken LinkIssue TrackingThird Party Advisory
blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714X Refsource MISCThird Party Advisory
www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-knowX Refsource MISCThird Party Advisory
twitter.com/RicterZ/status/984495201354854401X Refsource MISCBroken LinkThird Party Advisory
www.exploit-db.com/exploits/44449/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600Government ResourceUS Government Resource
ubuntu.com/security/CVE-2018-7600REPORT
www.drupal.org/psa-2018-001REPORT
www.cve.org/CVERecord?id=CVE-2018-7600REPORT
www.cisa.gov/known-exploited-vulnerabilities-catalogREPORT
ubuntu.com/security/notices/USN-4773-1Advisory

Related vulnerabilities

CVE-2018-19200debianuriparser+32.48%7y ago12-11-2018 15:00An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.CVE-2018-9861ckeditorenhanced_image+51.72%8y ago19-04-2018 17:00Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG element.CVE-2018-14773debiansymfony+457.64%8y ago03-08-2018 17:00An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.CVE-2018-7602debiandrupal7+4KEVRansomware99.17%8y ago19-07-2018 17:00A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.CVE-2003-0385debianxaos+10.86%23y ago10-06-2003 04:00Buffer overflow in xaos 3.0-23 and earlier, when running setuid, allows local users to gain root privileges via a long -language option.CVE-2003-0358debianfalconseye+51.22%23y ago30-05-2003 04:00Buffer overflow in (1) nethack 3.4.0 and earlier, and (2) falconseye 1.9.3 and earlier, which is based on nethack, allows local users to gain privileges via a long -s command line option.

All vulnerabilities indebian_linux drupal

CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References