critical
CVE-2018-7602
A remote code execution vulnerability exists within multiple subsystem ...
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA. Rated lower by Ubuntu (high).
Description
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| composer::GitHub Security Advisory Composer | drupal/core, drupal/drupal | 7.59, 8.4.8, 8.5.3 |
| alpine 3.10 | drupal7 | 7.59-r0 |
| alpine 3.11 | drupal7 | 7.59-r0 |
| alpine 3.12 | drupal7 | 7.59-r0 |
| alpine 3.13 | drupal7 | 7.59-r0 |
| alpine 3.14 | drupal7 | 7.59-r0 |
| alpine 3.15 | drupal7 | 7.59-r0 |
| alpine 3.16 | drupal7 | 7.59-r0 |
| alpine 3.17 | drupal7 | 7.59-r0 |
| alpine 3.18 | drupal7 | 7.59-r0 |
| alpine 3.19 | drupal7 | 7.59-r0 |
| alpine 3.20 | drupal7 | 7.59-r0 |
Show all 24 entries from 22 sources
| Source | Package | Fixed in |
|---|---|---|
| composer::GitHub Security Advisory Composer | drupal/core | 7.59, 8.4.8, 8.5.3 |
| composer::GitHub Security Advisory Composer | drupal/drupal | 7.59, 8.4.8, 8.5.3 |
| alpine 3.10 | drupal7 | 7.59-r0 |
| alpine 3.11 | drupal7 | 7.59-r0 |
| alpine 3.12 | drupal7 | 7.59-r0 |
| alpine 3.13 | drupal7 | 7.59-r0 |
| alpine 3.14 | drupal7 | 7.59-r0 |
| alpine 3.15 | drupal7 | 7.59-r0 |
| alpine 3.16 | drupal7 | 7.59-r0 |
| alpine 3.17 | drupal7 | 7.59-r0 |
| alpine 3.18 | drupal7 | 7.59-r0 |
| alpine 3.19 | drupal7 | 7.59-r0 |
| alpine 3.20 | drupal7 | 7.59-r0 |
| alpine 3.6 | drupal7 | 7.59-r0 |
| alpine 3.7 | drupal7 | 7.59-r0 |
| alpine 3.8 | drupal7 | 7.59-r0 |
| alpine 3.9 | drupal7 | 7.59-r0 |
| composer::PHP Security Advisories Database | drupal/core | no fix listed |
| composer::PHP Security Advisories Database | drupal/drupal | no fix listed |
| debian 7 | drupal7 | 7.14-2+deb7u19 |
| debian 8 | drupal7 | 7.32-1+deb8u12 |
| debian 9 | drupal7 | 7.52-2+deb9u4 |
| ubuntu 14.04-ESM | drupal7 | 7.26-1ubuntu0.1+esm1 |
| ubuntu 16.04-ESM | drupal7 | 7.44-1ubuntu1~16.04.0+esm1 |
References
- http://www.securityfocus.com/bid/103985
- http://www.securitytracker.com/id/1040754
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7602.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7602.yaml
- https://github.com/drupal/core
- https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-7602
- https://ubuntu.com/security/notices/USN-4773-1
All 18 references
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602
- https://www.cve.org/CVERecord?id=CVE-2018-7602
- https://www.debian.org/security/2018/dsa-4180
- https://www.drupal.org/psa-2018-003
- https://www.drupal.org/sa-core-2018-004
- https://www.exploit-db.com/exploits/44542
- https://www.exploit-db.com/exploits/44542/
- https://www.exploit-db.com/exploits/44557
- https://www.exploit-db.com/exploits/44557/