Lucene search
CVE-2018-7602
Drupal 7.x and 8.x multiple subsystems remote code execution vulnerability - Highly critical
Show more
| Reporter | Title | Published | Views | Family All 88 |
|---|---|---|---|---|
 | Drupal 7.58 - Drupalgeddon3 (Authenticated) Remote Code Execution (PoC) | 25 Apr 201800:00 | – | exploitpack |
| Drupal 7.58 - Drupalgeddon3 (Authenticated) Remote Code (Metasploit) | 30 Apr 201800:00 | – | exploitpack |
 | CVE-2018-7602 | 19 Jul 201817:29 | – | nvd |
 | Debian DLA-1365-1 : drupal7 security update (Drupalgeddon 2) | 27 Apr 201800:00 | – | nessus |
| Fedora 28 : drupal7 (2018-43c64deada) (Drupalgeddon 2) | 3 Jan 201900:00 | – | nessus |
| Fedora 26 : drupal7 (2018-2359c2ae0e) (Drupalgeddon 2) | 11 May 201800:00 | – | nessus |
| Drupal 7.x < 7.59 / 8.4.x < 8.4.8 / 8.5.x < 8.5.3 Remote Code Execution Vulnerability (SA-CORE-2018-004) | 25 Apr 201800:00 | – | nessus |
| Debian DSA-4180-1 : drupal7 - security update (Drupalgeddon 2) | 26 Apr 201800:00 | – | nessus |
| Fedora 27 : drupal7 (2018-b9ad458866) (Drupalgeddon 2) | 11 May 201800:00 | – | nessus |
| Fedora 27 : drupal8 (2018-1ba93b3144) (Drupalgeddon 2) | 11 May 201800:00 | – | nessus |
10
Node
[
{
"product": "core",
"vendor": "Drupal",
"versions": [
{
"lessThan": "7.59",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "8.5.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "8.4.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
]| Source | Link |
|---|---|
| exploit-db | www.exploit-db.com/exploits/44542/ |
| securitytracker | www.securitytracker.com/id/1040754 |
| exploit-db | www.exploit-db.com/exploits/44557/ |
| debian | www.debian.org/security/2018/dsa-4180 |
| securityfocus | www.securityfocus.com/bid/103985 |
| drupal | www.drupal.org/sa-core-2018-004 |
| lists | www.lists.debian.org/debian-lts-announce/2018/04/msg00030.html |
| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| destination | query param | /?q=node/1/delete&destination=node?q[%2523post_render][]=passthru%26q[%2523type]=markup%26q[%2523markup]=php%20-r%20'%{PAYLOAD}' | Exploitable query parameter that allows remote code execution via PHP code injection. | CWE-94 |
| form_build_id | query param | /?q=file/ajax/actions/cancel/%23options/path/{form_build_id} | Endpoint that can be exploited through the form build ID in the context of Drupal's AJAX actions. | CWE-94 |
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo19 Jul 2018 17:29Current
9.8High risk
Vulners AI Score9.8
CVSS27.5
CVSS39.8
EPSS0.94424