p PatchFirst

CVE-2018-7602

CVE-2018-7602 · Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

CVSS 8.1 · High · EPSS 99.2% · In KEV · Public exploit · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • core

    Versions
    • ≥ unspecified, < 7.59: Affected (custom)
    • ≥ unspecified, < 8.5.3: Affected (custom)
    • ≥ unspecified, < 8.4.8: Affected (custom)

    Update to 7.59

  • drupal/core Packagist

    Versions
    • 8.0.0
    • 8.0.1
    • 8.0.2
    • 8.0.3
    • 8.0.4
    • 8.0.5
    • 8.0.6
    • 8.1.0
    • 8.1.0-beta1
    • 8.1.0-beta2
    • 8.1.0-rc1
    • 8.1.1
    • 8.1.10
    • 8.1.2
    • 8.1.3
    • 8.1.4
    • 8.1.5
    • 8.1.6
    • 8.1.7
    • 8.1.8
    • 8.1.9
    • 8.2.0
    • 8.2.0-beta1
    • 8.2.0-beta2
    • 8.2.0-beta3
    • 8.2.0-rc1
    • 8.2.0-rc2
    • 8.2.1
    • 8.2.2
    • 8.2.3
    • 8.2.4
    • 8.2.5
    • 8.2.6
    • 8.2.7
    • 8.2.8
    • 8.3.0
    • 8.3.0-alpha1
    • 8.3.0-beta1
    • 8.3.0-rc1
    • 8.3.0-rc2
    • 8.3.1
    • 8.3.2
    • 8.3.3
    • 8.3.4
    • 8.3.5
    • 8.3.6
    • 8.3.7
    • 8.3.8
    • 8.3.9
    • 8.4.0
    • 8.4.0-alpha1
    • 8.4.0-beta1
    • 8.4.0-rc1
    • 8.4.0-rc2
    • 8.4.1
    • 8.4.2
    • 8.4.3
    • 8.4.4
    • 8.4.5
    • 8.4.6
    • 8.4.7
    • 8.5.0
    • 8.5.1
    • 8.5.2
    Affected ranges
    • ECOSYSTEM: ≥ 8.0.0, < 8.4.8
    • ECOSYSTEM: ≥ 8.5.0, < 8.5.3

    Update to 8.4.8; Update to 8.5.3

  • drupal/core Packagist

    Affected ranges
    • ECOSYSTEM: ≥ 7.0, < 7.59

    Update to 7.59

  • drupal/core Packagist

    Versions
    • 8.0.0
    • 8.0.0-beta10
    • 8.0.0-beta11
    • 8.0.0-beta12
    • 8.0.0-beta13
    • 8.0.0-beta14
    • 8.0.0-beta15
    • 8.0.0-beta16
    • 8.0.0-beta6
    • 8.0.0-beta7
    • 8.0.0-beta8
    • 8.0.0-beta9
    • 8.0.0-rc1
    • 8.0.0-rc2
    • 8.0.0-rc3
    • 8.0.0-rc4
    • 8.0.1
    • 8.0.2
    • 8.0.3
    • 8.0.4
    • 8.0.5
    • 8.0.6
    • 8.1.0
    • 8.1.0-beta1
    • 8.1.0-beta2
    • 8.1.0-rc1
    • 8.1.1
    • 8.1.10
    • 8.1.2
    • 8.1.3
    • 8.1.4
    • 8.1.5
    • 8.1.6
    • 8.1.7
    • 8.1.8
    • 8.1.9
    • 8.2.0
    • 8.2.0-beta1
    • 8.2.0-beta2
    • 8.2.0-beta3
    • 8.2.0-rc1
    • 8.2.0-rc2
    • 8.2.1
    • 8.2.2
    • 8.2.3
    • 8.2.4
    • 8.2.5
    • 8.2.6
    • 8.2.7
    • 8.2.8
    • 8.3.0
    • 8.3.0-alpha1
    • 8.3.0-beta1
    • 8.3.0-rc1
    • 8.3.0-rc2
    • 8.3.1
    • 8.3.2
    • 8.3.3
    • 8.3.4
    • 8.3.5
    • 8.3.6
    • 8.3.7
    • 8.3.8
    • 8.3.9
    • 8.4.0
    • 8.4.0-alpha1
    • 8.4.0-beta1
    • 8.4.0-rc1
    • 8.4.0-rc2
    • 8.4.1
    • 8.4.2
    • 8.4.3
    • 8.4.4
    • 8.4.5
    • 8.4.6
    • 8.4.7
    Affected ranges
    • ECOSYSTEM: ≥ 8.0, < 8.4.8

    Update to 8.4.8

  • drupal/core Packagist

    Versions
    • 8.5.0
    • 8.5.0-alpha1
    • 8.5.0-beta1
    • 8.5.0-rc1
    • 8.5.1
    • 8.5.2
    Affected ranges
    • ECOSYSTEM: ≥ 8.5, < 8.5.3

    Update to 8.5.3

  • drupal/drupal Packagist

    Affected ranges
    • ECOSYSTEM: ≥ 7.0, < 7.59

    Update to 7.59

  • drupal/drupal Packagist

    Versions
    • 8.0.0
    • 8.0.0-alpha14
    • 8.0.0-alpha15
    • 8.0.0-beta1
    • 8.0.0-beta10
    • 8.0.0-beta11
    • 8.0.0-beta12
    • 8.0.0-beta13
    • 8.0.0-beta14
    • 8.0.0-beta15
    • 8.0.0-beta16
    • 8.0.0-beta2
    • 8.0.0-beta3
    • 8.0.0-beta4
    • 8.0.0-beta5
    • 8.0.0-beta6
    • 8.0.0-beta7
    • 8.0.0-beta9
    • 8.0.0-rc1
    • 8.0.0-rc2
    • 8.0.0-rc3
    • 8.0.0-rc4
    • 8.0.1
    • 8.0.2
    • 8.0.3
    • 8.0.4
    • 8.0.5
    • 8.0.6
    • 8.1.0
    • 8.1.0-beta1
    • 8.1.0-beta2
    • 8.1.0-rc1
    • 8.1.1
    • 8.1.10
    • 8.1.2
    • 8.1.3
    • 8.1.4
    • 8.1.5
    • 8.1.6
    • 8.1.7
    • 8.1.8
    • 8.1.9
    • 8.2.0
    • 8.2.0-beta1
    • 8.2.0-beta2
    • 8.2.0-beta3
    • 8.2.0-rc1
    • 8.2.0-rc2
    • 8.2.1
    • 8.2.2
    • 8.2.3
    • 8.2.4
    • 8.2.5
    • 8.2.6
    • 8.2.7
    • 8.2.8
    • 8.3.0
    • 8.3.0-alpha1
    • 8.3.0-beta1
    • 8.3.0-rc1
    • 8.3.0-rc2
    • 8.3.1
    • 8.3.2
    • 8.3.3
    • 8.3.4
    • 8.3.5
    • 8.3.6
    • 8.3.7
    • 8.3.8
    • 8.3.9
    • 8.4.0
    • 8.4.0-alpha1
    • 8.4.0-beta1
    • 8.4.0-rc1
    • 8.4.0-rc2
    • 8.4.1
    • 8.4.2
    • 8.4.3
    • 8.4.4
    • 8.4.5
    • 8.4.6
    • 8.4.7
    Affected ranges
    • ECOSYSTEM: ≥ 8.0, < 8.4.8

    Update to 8.4.8

  • drupal/drupal Packagist

    Versions
    • 8.5.0
    • 8.5.0-alpha1
    • 8.5.0-beta1
    • 8.5.0-rc1
    • 8.5.1
    • 8.5.2
    Affected ranges
    • ECOSYSTEM: ≥ 8.5, < 8.5.3

    Update to 8.5.3

  • drupal7 Ubuntu:Pro:14.04:LTS

    Versions
    • 7.23-1
    • 7.24-1
    • 7.24-2
    • 7.26-1
    • 7.26-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 7.26-1ubuntu0.1+esm1

    Update to 7.26-1ubuntu0.1+esm1

  • drupal7 Ubuntu:Pro:16.04:LTS

    Versions
    • 7.38-1
    • 7.41-1
    • 7.44-1ubuntu1~16.04.0
    Affected ranges
    • ECOSYSTEM: < 7.44-1ubuntu1~16.04.0+esm1

    Update to 7.44-1ubuntu1~16.04.0+esm1

Original sources

Check your server →