PT-2018-3600 · Drupal+1 · Drupal+1

G0Tmi1K + 1 · Published 2018-03-28 · Updated 2026-03-10 · CVE-2018-7600

Positive Technologies · (AI Summary)

CVSS v2.0

10

Critical

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 7.58 Drupal versions 8.x prior to 8.3.9 Drupal versions 8.4.x prior to 8.4.6 Drupal versions 8.5.x prior to 8.5.1

Description The issue is related to insufficient input validation in the Drupal CMS system, allowing a remote attacker to execute arbitrary code and potentially take control of a site using a specially crafted HTTP request. This is due to a problem affecting multiple subsystems with default or common module configurations.

Recommendations For Drupal versions prior to 7.58, update to version 7.58 or later. For Drupal versions 8.x prior to 8.3.9, update to version 8.3.9 or later. For Drupal versions 8.4.x prior to 8.4.6, update to version 8.4.6 or later. For Drupal versions 8.5.x prior to 8.5.1, update to version 8.5.1 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-00549

CVE-2018-7600

DLA-1325-1

DRUPAL-CORE-2018-002

DSA-4156-1

GHSA-7FH9-933G-885P

USN-4773-1

Affected Products

Drupal

Ubuntu

References · 68

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/drupal_drupalgeddon2.rb · Exploit
• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2018-7600.md · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7600.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7600.yaml · Exploit
• 🔥 https://github.com/dreadlocked/Drupalgeddon2 · Exploit
• 🔥 https://github.com/a2u/CVE-2018-7600 · Exploit
• 🔥 https://github.com/pimps/CVE-2018-7600 · Exploit
• 🔥 https://github.com/g0rx/CVE-2018-7600-Drupal-RCE · Exploit
• 🔥 https://github.com/firefart/CVE-2018-7600 · Exploit
• 🔥 https://github.com/FireFart/CVE-2018-7600 · Exploit
• 🔥 https://github.com/lorddemon/drupalgeddon2 · Exploit
• 🔥 https://github.com/r3dxpl0it/CVE-2018-7600 · Exploit
• 🔥 https://github.com/dr-iman/CVE-2018-7600-Drupal-0day-RCE · Exploit
• 🔥 https://github.com/rabbitmask/CVE-2018-7600-Drupal7 · Exploit
• 🔥 https://github.com/zhzyker/CVE-2018-7600-Drupal-POC-EXP · Exploit