VULNERABILITY INTELLIGENCE

CVE-2018-7600

CVSS score9.8 CRITICAL

EPSS probability99.99%

CISA KEVKnown exploited vulnerability

Published2018-03-29

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Drupal Core Remote Code Execution Vulnerability

Vendor / product: Drupal / Drupal Core

Description

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

Weakness classification

CWE-20: Improper Input Validation

Primary references

mlhess@drupal.org — Broken Link, Third Party Advisory, VDB Entry
mlhess@drupal.org — Broken Link, Third Party Advisory, VDB Entry
mlhess@drupal.org — Broken Link, Third Party Advisory
mlhess@drupal.org — Third Party Advisory
mlhess@drupal.org — Third Party Advisory
mlhess@drupal.org — Patch, Third Party Advisory
mlhess@drupal.org — Broken Link, Issue Tracking, Third Party Advisory
mlhess@drupal.org — Vendor Advisory
mlhess@drupal.org — Third Party Advisory
mlhess@drupal.org — Exploit, Third Party Advisory
mlhess@drupal.org — Broken Link, Third Party Advisory
mlhess@drupal.org — Broken Link, Third Party Advisory