VDB
CVE-2018-7602
CVE-2018-7602
PUBLISHED
KEV
CVSS 9.800000190734863 CRITICAL
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
EPSS 99.20% · 99.9th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
99.20%
99.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:Pro:14.04:LTS | drupal7 | 7.23-1, 7.24-1, 7.24-2 |
| Ubuntu:Pro:16.04:LTS | drupal7 | 0, 7.41-1, * |
Timeline
- CVE Published
- Mar 30, 2018 VulnCheck XDB Entry
- Mar 30, 2018 VulnCheck XDB Entry
- Apr 12, 2018 VulnCheck XDB Entry
- Apr 13, 2018 VulnCheck XDB Entry
- Apr 14, 2018 VulnCheck XDB Entry
- Apr 14, 2018 VulnCheck XDB Entry
- Apr 15, 2018 VulnCheck XDB Entry
- Apr 16, 2018 VulnCheck XDB Entry
- Apr 17, 2018 VulnCheck XDB Entry
- Apr 19, 2018 VulnCheck XDB Entry
- Apr 20, 2018 VulnCheck KEV Exploitation
References
- Nuclei Template exploit
- https://ubuntu.com/security/CVE-2018-7602 third-party-advisory
- https://www.drupal.org/psa-2018-003 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2018-7602 third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog third-party-advisory
- https://ubuntu.com/security/notices/USN-4773-1 vendor-advisory
- Multiples vulnérabilités dans Drupal advisory