CVE-2018-7602: Drupal Core Remote Code Execution Vulnerability

Vulnerability summary

CVE-2018-7602 is a critical (CVSS 9.8) Code Injection vulnerability in Drupal Core. It is known to be exploited: CISA lists it, first on 13-04-2022. It has been used in ransomware campaigns. EPSS estimates a 99.17% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 19-07-2018
   PublishedVulnerability first disclosed.
2. 13-04-2022
   Added to CISA KEVDrupal Core Remote Code Execution Vulnerability
3. 04-05-2022
   CISA remediation dueApply updates per vendor instructions.
4. 01-10-2026
   Last modifiedVulnerability information updated.

Description

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.