CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: May 3, 2022

CVE-2018-7600

High

CVSS 9.8EPSS 94.5%CISA KEVPoC AvailableRansomware

Drupal/Drupal Core

Description

Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.

CVSS Score

9.8/ 10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Probability

94.5%

Higher than 100.0% of all CVEs

Weakness Classification (CWE)

CWE-20Improper Input ValidationMITRE

Known Exploits

POC

http://www.securityfocus.com/bid/103534Broken Link http://www.securitytracker.com/id/1040598Broken Link https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/Broken Link https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714Third Party Advisory https://github.com/a2u/CVE-2018-7600Third Party Advisory https://github.com/g0rx/CVE-2018-7600-Drupal-RCEPatch https://greysec.net/showthread.php?tid=2912&pid=10561Broken Link https://lists.debian.org/debian-lts-announce/2018/03/msg00028.htmlThird Party Advisory https://research.checkpoint.com/uncovering-drupalgeddon-2/Exploit https://twitter.com/RicterZ/status/979567469726613504Broken Link https://twitter.com/RicterZ/status/984495201354854401Broken Link https://twitter.com/arancaytar/status/979090719003627521Third Party Advisory https://www.debian.org/security/2018/dsa-4156Third Party Advisory https://www.exploit-db.com/exploits/44448/Exploit https://www.exploit-db.com/exploits/44449/Exploit https://www.exploit-db.com/exploits/44482/Exploit https://www.synology.com/support/security/Synology_SA_18_17Third Party Advisory https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-knowThird Party Advisory http://www.securityfocus.com/bid/103534Broken Link http://www.securitytracker.com/id/1040598Broken Link https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/Broken Link https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714Third Party Advisory https://github.com/a2u/CVE-2018-7600Third Party Advisory https://github.com/g0rx/CVE-2018-7600-Drupal-RCEPatch https://greysec.net/showthread.php?tid=2912&pid=10561Broken Link https://lists.debian.org/debian-lts-announce/2018/03/msg00028.htmlThird Party Advisory https://research.checkpoint.com/uncovering-drupalgeddon-2/Exploit https://twitter.com/RicterZ/status/979567469726613504Broken Link https://twitter.com/RicterZ/status/984495201354854401Broken Link https://twitter.com/arancaytar/status/979090719003627521Third Party Advisory https://www.debian.org/security/2018/dsa-4156Third Party Advisory https://www.exploit-db.com/exploits/44448/Exploit https://www.exploit-db.com/exploits/44449/Exploit https://www.exploit-db.com/exploits/44482/Exploit https://www.synology.com/support/security/Synology_SA_18_17Third Party Advisory https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-knowThird Party Advisory

Required Action

https://nvd.nist.gov/vuln/detail/CVE-2018-7600

Risk Assessment

CRITICAL

In CISA KEV

Known exploit

Critical CVSS

High EPSS

Ransomware

Details

Severity: High
CVSS: 9.8
EPSS: 94.5%
CWE: CWE-20
Exploit: POC
CISA KEV: Yes
Ransomware: Known
Articles: 0

Timeline

Published

Nov 3, 2021

Added to KEV

Nov 3, 2021

Remediation Due

May 3, 2022

Affected Product

Drupal

Drupal Core

View all Drupal CVEs

External Links

NVD (NIST)CVE Details MITRE CVE