Description

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised.

Remediation

Upgrade to the most recent version of Drupal 7 or 8 core.

If you are running 7.x, upgrade to Drupal 7.58.
If you are running 8.5.x, upgrade to Drupal 8.5.1.

References

Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002

Uncovering Drupalgeddon 2

Related Vulnerabilities

WordPress Plugin Similar Posts-Best Related Posts for WordPress Remote Code Execution (3.1.5)

WordPress Plugin Loco Translate PHP Code Injection (2.5.3)

F5 BIG-IP Traffic Management User Interface (TMUI) RCE

XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-37909)

Ivanti Sentry Authentication Bypass (CVE-2023-38035)

Severity

High

Classification

CVE-2018-7600 CWE-94 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution