Drupalgeddon 2 (CVE-2018-7600)
Drupal Core Remote Code Execution Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2018-7600
Also Known as Drupalgeddon 2
Drupalgeddon 2 is the nickname for a remote code execution flaw in Drupal core, published by the Drupal security team in March 2018 as SA-CORE-2018-002. Check Point and Dofinity later published technical details, after which exploitation became widespread.
Other names: Drupalgeddon2
Name sources
Description
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected Products
| Vendor | Product | Affected versions |
|---|---|---|
| - | Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 | Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 |
References
20 Links- https://github.com/g0rx/CVE-2018-7600-Drupal-RCE
- https://twitter.com/arancaytar/status/979090719003627521
- https://twitter.com/RicterZ/status/979567469726613504
- https://www.drupal.org/sa-core-2018-002
- https://www.synology.com/support/security/Synology_SA_18_17
- https://github.com/a2u/CVE-2018-7600
- https://research.checkpoint.com/uncovering-drupalgeddon-2/
- https://groups.drupal.org/security/faq-2018-002
- https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/
- https://greysec.net/showthread.php?tid=2912&pid=10561
- https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714
- https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know
- https://twitter.com/RicterZ/status/984495201354854401
Record Details
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.