CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability
Summary
CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability. Affects drupal/core across 4 version ranges.
>= 7.0, < 7.58
>= 8.0, < 8.3.9
>= 8.4.0, < 8.4.6
>= 8.5.0, < 8.5.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal is a popular open-source content management system (CMS) used for building websites and applications. It provides a flexible and extensible platform for creating and managing digital content. The Drupal core package is the foundation of the CMS and includes essential features and functionality. However, a vulnerability has been discovered in Drupal versions before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 that allows remote attackers to execute arbitrary code. This vulnerability affects multiple subsystems with default or common module configurations.
Vulnerability Detail
The vulnerability in Drupal allows remote attackers to execute arbitrary code due to an issue affecting multiple subsystems with default or common module configurations. This means that an attacker can exploit the vulnerability to execute malicious code on a Drupal-based website or application. The impact of this vulnerability can be severe, as it provides unauthorized access and control over the affected system. The vulnerability has a CVSS score of 9.8, indicating its criticality.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0, < 7.587.58composer require drupal/core:7.58 -
>= 8.0, < 8.3.98.3.9composer require drupal/core:8.3.9 -
>= 8.4.0, < 8.4.68.4.6composer require drupal/core:8.4.6 -
>= 8.5.0, < 8.5.18.5.1composer require drupal/core:8.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, a temporary workaround is to disable the affected modules or configurations. By disabling the modules or configurations that are vulnerable, the risk of exploitation can be reduced. However, this is only a temporary solution, and updating to the latest version is still recommended for long-term security.
Conclusion
The Drupal Core Remote Code Execution Vulnerability (CVE-2018-7600) is a critical vulnerability that allows remote attackers to execute arbitrary code on Drupal-based websites or applications. To mitigate this vulnerability, it is crucial to update Drupal to the latest version available. Regularly updating Drupal and its modules is also important to stay protected against future vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for drupal/core →
FAQ
Drupal is an open-source content management system (CMS) used for building websites and applications. It provides a flexible and extensible platform for creating and managing digital content.
The vulnerability allows remote attackers to execute arbitrary code on a Drupal-based website or application. This can result in unauthorized access and control over the affected system.
To fix this vulnerability, update Drupal to the latest version available. For Drupal 7, update to version 7.58 or later. For Drupal 8, update to version 8.3.9 or later, 8.4.6 or later, or 8.5.1 or later.
A temporary workaround is to disable the affected modules or configurations. However, updating to the latest version is still recommended for long-term security.
Regularly updating Drupal and its modules is important to stay protected against future vulnerabilities. It is recommended to keep track of security advisories and apply updates as soon as they are available.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
