CVE-2018-7600

Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score30.8640%

EPSS Percentile90.48th

Published2018年3月29日

Last Modified2025年10月31日

Vulnerability Description

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Affected Platforms (CPE)

📦

Drupal

<= 7.57

📦

Drupal

>= 8.0.0 and < 8.3.9

📦

Drupal

>= 8.4.0 and < 8.4.6

📦

Drupal

>= 8.5.0 and < 8.5.1

💻

Debian

Debian Linux

= 7.0

💻

Debian

Debian Linux

= 8.0

💻

Debian

Debian Linux

= 9.0

References & Advisories

🔗 http://www.securityfocus.com/bid/103534

🔗 http://www.securitytracker.com/id/1040598

🔗 https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/

🔗 https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714

🔗 https://github.com/a2u/CVE-2018-7600

🔗 https://github.com/g0rx/CVE-2018-7600-Drupal-RCE

🔗 https://greysec.net/showthread.php?tid=2912&pid=10561

🔗 https://groups.drupal.org/security/faq-2018-002

Vulnerability Description

Affected Platforms (CPE)

Drupal

Drupal

Drupal

Drupal

Debian Linux

Debian Linux

Debian Linux

References & Advisories

相關漏洞威脅