Description

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised.

Remediation

Upgrade to the most recent version of Drupal 7 or 8 core.

If you are running 7.x, upgrade to Drupal 7.58.
If you are running 8.5.x, upgrade to Drupal 8.5.1.

References

Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002

Uncovering Drupalgeddon 2

Related Vulnerabilities

HipChat for JIRA plugin - Velocity template injection

WordPress Plugin Share Possible Remote Code Execution (1.0)

WordPress Plugin Coming Soon Possible Remote Code Execution (1.1.3)

XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-40177)

Plone arbitrary code execution

Severity

High

Classification

CVE-2018-7600 CWE-94 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution