{"containers": {"cna": {"affected": [{"product": "Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1", "vendor": "n/a", "versions": [{"status": "affected", "version": "Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1"}]}], "datePublic": "2018-03-29T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations."}], "problemTypes": [{"descriptions": [{"description": "remote code execution", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-06-11T12:57:01.000Z", "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/g0rx/CVE-2018-7600-Drupal-RCE"}, {"name": "1040598", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1040598"}, {"tags": ["x_refsource_MISC"], "url": "https://twitter.com/arancaytar/status/979090719003627521"}, {"tags": ["x_refsource_MISC"], "url": "https://twitter.com/RicterZ/status/979567469726613504"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.drupal.org/sa-core-2018-002"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.synology.com/support/security/Synology_SA_18_17"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/a2u/CVE-2018-7600"}, {"name": "44482", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/44482/"}, {"tags": ["x_refsource_MISC"], "url": "https://research.checkpoint.com/uncovering-drupalgeddon-2/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://groups.drupal.org/security/faq-2018-002"}, {"name": "DSA-4156", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2018/dsa-4156"}, {"name": "[debian-lts-announce] 20180328 [SECURITY] [DLA 1325-1] drupal7 security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html"}, {"name": "44448", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/44448/"}, {"name": "103534", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/103534"}, {"tags": ["x_refsource_MISC"], "url": "https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/"}, {"tags": ["x_refsource_MISC"], "url": "https://greysec.net/showthread.php?tid=2912&pid=10561"}, {"tags": ["x_refsource_MISC"], "url": "https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714"}, {"tags": ["x_refsource_MISC"], "url": "https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know"}, {"tags": ["x_refsource_MISC"], "url": "https://twitter.com/RicterZ/status/984495201354854401"}, {"name": "44449", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/44449/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@drupal.org", "ID": "CVE-2018-7600", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1", "version": {"version_data": [{"version_value": "Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "remote code execution"}]}]}, "references": {"reference_data": [{"name": "https://github.com/g0rx/CVE-2018-7600-Drupal-RCE", "refsource": "MISC", "url": "https://github.com/g0rx/CVE-2018-7600-Drupal-RCE"}, {"name": "1040598", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1040598"}, {"name": "https://twitter.com/arancaytar/status/979090719003627521", "refsource": "MISC", "url": "https://twitter.com/arancaytar/status/979090719003627521"}, {"name": "https://twitter.com/RicterZ/status/979567469726613504", "refsource": "MISC", "url": "https://twitter.com/RicterZ/status/979567469726613504"}, {"name": "https://www.drupal.org/sa-core-2018-002", "refsource": "CONFIRM", "url": "https://www.drupal.org/sa-core-2018-002"}, {"name": "https://www.synology.com/support/security/Synology_SA_18_17", "refsource": "CONFIRM", "url": "https://www.synology.com/support/security/Synology_SA_18_17"}, {"name": "https://github.com/a2u/CVE-2018-7600", "refsource": "MISC", "url": "https://github.com/a2u/CVE-2018-7600"}, {"name": "44482", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/44482/"}, {"name": "https://research.checkpoint.com/uncovering-drupalgeddon-2/", "refsource": "MISC", "url": "https://research.checkpoint.com/uncovering-drupalgeddon-2/"}, {"name": "https://groups.drupal.org/security/faq-2018-002", "refsource": "CONFIRM", "url": "https://groups.drupal.org/security/faq-2018-002"}, {"name": "DSA-4156", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2018/dsa-4156"}, {"name": "[debian-lts-announce] 20180328 [SECURITY] [DLA 1325-1] drupal7 security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html"}, {"name": "44448", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/44448/"}, {"name": "103534", "refsource": "BID", "url": "http://www.securityfocus.com/bid/103534"}, {"name": "https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/", "refsource": "MISC", "url": "https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/"}, {"name": "https://greysec.net/showthread.php?tid=2912&pid=10561", "refsource": "MISC", "url": "https://greysec.net/showthread.php?tid=2912&pid=10561"}, {"name": "https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714", "refsource": "MISC", "url": "https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714"}, {"name": "https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know", "refsource": "MISC", "url": "https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know"}, {"name": "https://twitter.com/RicterZ/status/984495201354854401", "refsource": "MISC", "url": "https://twitter.com/RicterZ/status/984495201354854401"}, {"name": "44449", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/44449/"}]}}, "x_gcve": [{"vulnId": "CVE-2018-7600", "recordType": "advisory"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:31:04.955Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/g0rx/CVE-2018-7600-Drupal-RCE"}, {"name": "1040598", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1040598"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://twitter.com/arancaytar/status/979090719003627521"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://twitter.com/RicterZ/status/979567469726613504"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.drupal.org/sa-core-2018-002"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.synology.com/support/security/Synology_SA_18_17"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/a2u/CVE-2018-7600"}, {"name": "44482", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/44482/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://research.checkpoint.com/uncovering-drupalgeddon-2/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://groups.drupal.org/security/faq-2018-002"}, {"name": "DSA-4156", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2018/dsa-4156"}, {"name": "[debian-lts-announce] 20180328 [SECURITY] [DLA 1325-1] drupal7 security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html"}, {"name": "44448", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/44448/"}, {"name": "103534", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/103534"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://greysec.net/showthread.php?tid=2912&pid=10561"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://twitter.com/RicterZ/status/984495201354854401"}, {"name": "44449", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/44449/"}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2018-7600", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-07T12:40:15.444546Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2021-11-03", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600"}}}], "references": [{"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600", "tags": ["government-resource"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "timeline": [{"time": "2021-11-03T00:00:00.000Z", "lang": "en", "value": "CVE-2018-7600 added to CISA KEV"}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-21T23:45:52.444Z"}}]}, "cveMetadata": {"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "assignerShortName": "drupal", "cveId": "CVE-2018-7600", "datePublished": "2018-03-29T07:00:00.000Z", "dateReserved": "2018-03-01T00:00:00.000Z", "dateUpdated": "2025-10-21T23:45:52.444Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": {"cisa_known_exploited": {"cveID": "CVE-2018-7600", "cwes": "[\"CWE-20\"]", "dateAdded": "2021-11-03", "dueDate": "2022-05-03", "forensicTriage": "No", "knownRansomwareCampaignUse": "Known", "notes": "https://nvd.nist.gov/vuln/detail/CVE-2018-7600", "product": "Drupal Core", "requiredAction": "Apply updates per vendor instructions.", "shortDescription": "Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.", "vendorProject": "Drupal", "vulnerabilityName": "Drupal Core Remote Code Execution Vulnerability"}, "epss": {"cve": "CVE-2018-7600", "date": "2026-09-28", "epss": "0.99991", "percentile": "0.99985"}, "nvd": "{\"cve\":{\"id\":\"CVE-2018-7600\",\"sourceIdentifier\":\"mlhess@drupal.org\",\"published\":\"2018-03-29T07:29:00.260\",\"lastModified\":\"2025-10-31T22:05:42.410\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.\"},{\"lang\":\"es\",\"value\":\"Drupal en versiones anteriores a la 7.58, 8.x anteriores a la 8.3.9, 8.4.x anteriores a la 8.4.6 y 8.5.x anteriores a la 8.5.1 permite que los atacantes remotos ejecuten c\u00f3digo arbitrario debido a un problema que afecta a m\u00faltiples subsistemas con configuraciones de m\u00f3dulos por defecto o comunes.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"cisaExploitAdd\":\"2021-11-03\",\"cisaActionDue\":\"2022-05-03\",\"cisaRequiredAction\":\"Apply updates per vendor instructions.\",\"cisaVulnerabilityName\":\"Drupal Core Remote Code Execution Vulnerability\",\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"7.57\",\"matchCriteriaId\":\"32918FBA-EEAE-4103-AD2A-0E1914790A2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.3.9\",\"matchCriteriaId\":\"CB9AA188-842A-4465-833B-066371D5611E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.4.0\",\"versionEndExcluding\":\"8.4.6\",\"matchCriteriaId\":\"0C796B60-2568-4E1F-A4CC-710DF21924BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.5.0\",\"versionEndExcluding\":\"8.5.1\",\"matchCriteriaId\":\"FE407010-FFFB-454E-B14A-56AD24B2997C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16F59A04-14CF-49E2-9973-645477EA09DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/103534\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1040598\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Broken Link\",\"Third Party Advisory\"]},{\"url\":\"https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/a2u/CVE-2018-7600\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/g0rx/CVE-2018-7600-Drupal-RCE\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://greysec.net/showthread.php?tid=2912&pid=10561\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Broken Link\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://groups.drupal.org/security/faq-2018-002\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://research.checkpoint.com/uncovering-drupalgeddon-2/\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://twitter.com/RicterZ/status/979567469726613504\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Broken Link\",\"Third Party Advisory\"]},{\"url\":\"https://twitter.com/RicterZ/status/984495201354854401\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Broken Link\",\"Third Party Advisory\"]},{\"url\":\"https://twitter.com/arancaytar/status/979090719003627521\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2018/dsa-4156\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.drupal.org/sa-core-2018-002\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.exploit-db.com/exploits/44448/\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.exploit-db.com/exploits/44449/\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.exploit-db.com/exploits/44482/\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.synology.com/support/security/Synology_SA_18_17\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know\",\"source\":\"mlhess@drupal.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/103534\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1040598\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Third Party Advisory\"]},{\"url\":\"https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/a2u/CVE-2018-7600\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/g0rx/CVE-2018-7600-Drupal-RCE\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://greysec.net/showthread.php?tid=2912&pid=10561\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://groups.drupal.org/security/faq-2018-002\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://research.checkpoint.com/uncovering-drupalgeddon-2/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://twitter.com/RicterZ/status/979567469726613504\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Third Party Advisory\"]},{\"url\":\"https://twitter.com/RicterZ/status/984495201354854401\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Third Party Advisory\"]},{\"url\":\"https://twitter.com/arancaytar/status/979090719003627521\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2018/dsa-4156\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.drupal.org/sa-core-2018-002\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.exploit-db.com/exploits/44448/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.exploit-db.com/exploits/44449/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.exploit-db.com/exploits/44482/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.synology.com/support/security/Synology_SA_18_17\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}", "redhat_vex": {"current_release_date": "2025-11-21T13:56:03+00:00", "cve": "CVE-2018-7600", "id": "CVE-2018-7600", "initial_release_date": "2018-03-29T00:00:00+00:00", "product_status:known_not_affected": "1", "source": "Red Hat CSAF VEX", "status": "final", "title": "drupal: Unsanitized requests allow remote attackers to execute arbitrary code", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-7600.json", "version": "3"}, "vulnrichment": {"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/g0rx/CVE-2018-7600-Drupal-RCE\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"http://www.securitytracker.com/id/1040598\", \"name\": \"1040598\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\", \"x_transferred\"]}, {\"url\": \"https://twitter.com/arancaytar/status/979090719003627521\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://twitter.com/RicterZ/status/979567469726613504\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://www.drupal.org/sa-core-2018-002\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://www.synology.com/support/security/Synology_SA_18_17\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/a2u/CVE-2018-7600\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://www.exploit-db.com/exploits/44482/\", \"name\": \"44482\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"]}, {\"url\": \"https://research.checkpoint.com/uncovering-drupalgeddon-2/\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://groups.drupal.org/security/faq-2018-002\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://www.debian.org/security/2018/dsa-4156\", \"name\": \"DSA-4156\", \"tags\": [\"vendor-advisory\", \"x_refsource_DEBIAN\", \"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html\", \"name\": \"[debian-lts-announce] 20180328 [SECURITY] [DLA 1325-1] drupal7 security update\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\", \"x_transferred\"]}, {\"url\": \"https://www.exploit-db.com/exploits/44448/\", \"name\": \"44448\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"]}, {\"url\": \"http://www.securityfocus.com/bid/103534\", \"name\": \"103534\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\", \"x_transferred\"]}, {\"url\": \"https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://greysec.net/showthread.php?tid=2912&pid=10561\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://twitter.com/RicterZ/status/984495201354854401\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://www.exploit-db.com/exploits/44449/\", \"name\": \"44449\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-05T06:31:04.955Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2018-7600\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-07T12:40:15.444546Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2021-11-03\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600\"}}}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2021-11-03T00:00:00.000Z\", \"value\": \"CVE-2018-7600 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600\", \"tags\": [\"government-resource\"]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-07T12:39:01.170Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1\", \"versions\": [{\"status\": \"affected\", \"version\": \"Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1\"}]}], \"datePublic\": \"2018-03-29T00:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/g0rx/CVE-2018-7600-Drupal-RCE\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"http://www.securitytracker.com/id/1040598\", \"name\": \"1040598\", \"tags\": [\"vdb-entry\", \"x_refsource_SECTRACK\"]}, {\"url\": \"https://twitter.com/arancaytar/status/979090719003627521\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://twitter.com/RicterZ/status/979567469726613504\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.drupal.org/sa-core-2018-002\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://www.synology.com/support/security/Synology_SA_18_17\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/a2u/CVE-2018-7600\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.exploit-db.com/exploits/44482/\", \"name\": \"44482\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"]}, {\"url\": \"https://research.checkpoint.com/uncovering-drupalgeddon-2/\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://groups.drupal.org/security/faq-2018-002\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://www.debian.org/security/2018/dsa-4156\", \"name\": \"DSA-4156\", \"tags\": [\"vendor-advisory\", \"x_refsource_DEBIAN\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html\", \"name\": \"[debian-lts-announce] 20180328 [SECURITY] [DLA 1325-1] drupal7 security update\", \"tags\": [\"mailing-list\", \"x_refsource_MLIST\"]}, {\"url\": \"https://www.exploit-db.com/exploits/44448/\", \"name\": \"44448\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"]}, {\"url\": \"http://www.securityfocus.com/bid/103534\", \"name\": \"103534\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\"]}, {\"url\": \"https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://greysec.net/showthread.php?tid=2912&pid=10561\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://twitter.com/RicterZ/status/984495201354854401\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.exploit-db.com/exploits/44449/\", \"name\": \"44449\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"remote code execution\"}]}], \"providerMetadata\": {\"orgId\": \"2c85b837-eb8b-40ed-9d74-228c62987387\", \"shortName\": \"drupal\", \"dateUpdated\": \"2018-06-11T12:57:01.000Z\"}, \"x_legacyV4Record\": {\"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1\"}]}, \"product_name\": \"Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1\"}]}, \"vendor_name\": \"n/a\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://github.com/g0rx/CVE-2018-7600-Drupal-RCE\", \"name\": \"https://github.com/g0rx/CVE-2018-7600-Drupal-RCE\", \"refsource\": \"MISC\"}, {\"url\": \"http://www.securitytracker.com/id/1040598\", \"name\": \"1040598\", \"refsource\": \"SECTRACK\"}, {\"url\": \"https://twitter.com/arancaytar/status/979090719003627521\", \"name\": \"https://twitter.com/arancaytar/status/979090719003627521\", \"refsource\": \"MISC\"}, {\"url\": \"https://twitter.com/RicterZ/status/979567469726613504\", \"name\": \"https://twitter.com/RicterZ/status/979567469726613504\", \"refsource\": \"MISC\"}, {\"url\": \"https://www.drupal.org/sa-core-2018-002\", \"name\": \"https://www.drupal.org/sa-core-2018-002\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://www.synology.com/support/security/Synology_SA_18_17\", \"name\": \"https://www.synology.com/support/security/Synology_SA_18_17\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://github.com/a2u/CVE-2018-7600\", \"name\": \"https://github.com/a2u/CVE-2018-7600\", \"refsource\": \"MISC\"}, {\"url\": \"https://www.exploit-db.com/exploits/44482/\", \"name\": \"44482\", \"refsource\": \"EXPLOIT-DB\"}, {\"url\": \"https://research.checkpoint.com/uncovering-drupalgeddon-2/\", \"name\": \"https://research.checkpoint.com/uncovering-drupalgeddon-2/\", \"refsource\": \"MISC\"}, {\"url\": \"https://groups.drupal.org/security/faq-2018-002\", \"name\": \"https://groups.drupal.org/security/faq-2018-002\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://www.debian.org/security/2018/dsa-4156\", \"name\": \"DSA-4156\", \"refsource\": \"DEBIAN\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html\", \"name\": \"[debian-lts-announce] 20180328 [SECURITY] [DLA 1325-1] drupal7 security update\", \"refsource\": \"MLIST\"}, {\"url\": \"https://www.exploit-db.com/exploits/44448/\", \"name\": \"44448\", \"refsource\": \"EXPLOIT-DB\"}, {\"url\": \"http://www.securityfocus.com/bid/103534\", \"name\": \"103534\", \"refsource\": \"BID\"}, {\"url\": \"https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/\", \"name\": \"https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/\", \"refsource\": \"MISC\"}, {\"url\": \"https://greysec.net/showthread.php?tid=2912&pid=10561\", \"name\": \"https://greysec.net/showthread.php?tid=2912&pid=10561\", \"refsource\": \"MISC\"}, {\"url\": \"https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714\", \"name\": \"https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714\", \"refsource\": \"MISC\"}, {\"url\": \"https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know\", \"name\": \"https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know\", \"refsource\": \"MISC\"}, {\"url\": \"https://twitter.com/RicterZ/status/984495201354854401\", \"name\": \"https://twitter.com/RicterZ/status/984495201354854401\", \"refsource\": \"MISC\"}, {\"url\": \"https://www.exploit-db.com/exploits/44449/\", \"name\": \"44449\", \"refsource\": \"EXPLOIT-DB\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"remote code execution\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2018-7600\", \"STATE\": \"PUBLIC\", \"ASSIGNER\": \"security@drupal.org\"}}}}", "cveMetadata": "{\"cveId\": \"CVE-2018-7600\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-21T23:45:52.444Z\", \"dateReserved\": \"2018-03-01T00:00:00.000Z\", \"assignerOrgId\": \"2c85b837-eb8b-40ed-9d74-228c62987387\", \"datePublished\": \"2018-03-29T07:00:00.000Z\", \"assignerShortName\": \"drupal\"}", "dataType": "CVE_RECORD", "dataVersion": "5.1"}}}