Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

CPENameOperatorVersion
drupal/drupaleq8.3.3
drupal/drupaleq8.0.0-rc4
drupal/drupaleq8.1.7
drupal/coreeq8.2.4
drupal/coreeq8.1.0-beta1
drupal/drupaleq8.2.0-beta2
drupal/drupaleq8.0.0-beta5
drupal/drupaleq8.0.0-rc1
drupal/drupaleq8.1.0-beta2
drupal/drupaleq8.2.8

Name	Operator	Version
drupal/drupal	eq	8.3.3
drupal/drupal	eq	8.0.0-rc4
drupal/drupal	eq	8.1.7
drupal/core	eq	8.2.4
drupal/core	eq	8.1.0-beta1
drupal/drupal	eq	8.2.0-beta2
drupal/drupal	eq	8.0.0-beta5
drupal/drupal	eq	8.0.0-rc1
drupal/drupal	eq	8.1.0-beta2
drupal/drupal	eq	8.2.8

Rows per page:

1-10 of 1531

References

www.securityfocus.com/bid/103534

www.securitytracker.com/id/1040598

badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600

blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714

github.com/a2u/CVE-2018-7600

github.com/drupal/core

github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7600.yaml

github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7600.yaml

github.com/g0rx/CVE-2018-7600-Drupal-RCE

greysec.net/showthread.php?tid=2912&pid=10561

groups.drupal.org/security/faq-2018-002

lists.debian.org/debian-lts-announce/2018/03/msg00028.html

nvd.nist.gov/vuln/detail/CVE-2018-7600

research.checkpoint.com/uncovering-drupalgeddon-2

twitter.com/arancaytar/status/979090719003627521

twitter.com/RicterZ/status/979567469726613504

twitter.com/RicterZ/status/984495201354854401

www.debian.org/security/2018/dsa-4156

www.drupal.org/sa-core-2018-002

www.exploit-db.com/exploits/44448

www.exploit-db.com/exploits/44449

www.exploit-db.com/exploits/44482

www.synology.com/support/security/Synology_SA_18_17

www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know

nessus 8

zdt 4

threatpost 11

checkpoint_advisories 2

cisa_kev 1

osv 4

ibm 1

saint 3

dsquare 2

openvas 18

freebsd 1

qualysblog 6

alpinelinux 1

thn 8

packetstorm 4

f5 1

hackerone 1

nvd 1

debian 3

cve 1

veracode 2

exploitpack 3

debiancve 1

prion 1

impervablog 3

friendsofphp 2

metasploit 1

wallarmlab 1

archlinux 1

cvelist 1

nuclei 1

ubuntucve 1

seebug 1

github 1

attackerkb 1

exploitdb 3

githubexploit 1

malwarebytes 1

hivepro 1

avleonov 1

ubuntu 1

kitploit 5

securelist 1

talosblog 2

fedora 11

ics 2

fireeye 1

nessus

Debian DSA-4156-1 : drupal7 - security update (Drupalgeddon 2)

2018-03-29 00:00:00

Drupal 7.x < 7.58 / 8.3.x < 8.3.9 / 8.4.x < 8.4.6 / 8.5.x < 8.5.1 Remote Code Execution Vulnerability (SA-CORE-2018-002)

2018-03-28 00:00:00

Drupal Remote Code Execution Vulnerability (SA-CORE-2018-002) (exploit)

2018-04-13 00:00:00

zdt

Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 Drupalgeddon2 Remote Code Execution Exploit

2018-04-13 00:00:00

Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - Drupalgeddon2 Remote Code Execution Exploit

2018-04-18 00:00:00

Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 Drupalgeddon2 Remote Code Execution Exploit

2018-04-17 00:00:00

threatpost

Cryptojacking Campaign Exploits Drupal Bug, Over 400 Websites Attacked

2018-05-07 16:16:20

Kitty Cryptomining Malware Cashes in on Drupalgeddon 2.0

2018-05-03 16:57:19

New Drupalgeddon Attacks Enlist Shellbot to Open Backdoors

2018-10-11 20:24:54

checkpoint_advisories

Drupal Core Remote Code Execution (CVE-2018-7600)

2018-03-29 00:00:00

Drupal Core Form Rendering Remote Code Execution (CVE-2018-7600)

2020-11-05 00:00:00

cisa_kev

Drupal Core Remote Code Execution Vulnerability

2021-11-03 00:00:00

osv

drupal7 - security update

2018-03-29 00:00:00

drupal7 - security update

2018-03-28 00:00:00

CVE-2018-7600

2018-03-29 07:29:00

ibm

Security Bulletin: API Connect Developer Portal is affected by Drupal vulnerability (CVE-2018-7600)

2018-06-15 07:09:07

saint

Drupal Form API command execution

2018-04-25 00:00:00

Drupal Form API command execution

2018-04-25 00:00:00

Drupal Form API command execution

2018-04-25 00:00:00

dsquare

Drupal 8 SA-CORE-2018-002 RCE

2018-05-08 00:00:00

Drupal 7 SA-CORE-2018-002 RCE

2018-05-08 00:00:00

openvas

Drupal Core Critical Remote Code Execution Vulnerability (SA-CORE-2018-002) - Linux, Version Check

2018-03-29 00:00:00

Debian: Security Advisory (DLA-1325-1)

2018-03-28 00:00:00

Drupal Core Critical RCE Vulnerability (SA-CORE-2018-002) - Active Check

2018-04-14 00:00:00

freebsd

drupal -- Drupal Core - Multiple Vulnerabilities

2018-03-13 00:00:00

qualysblog

Staying Safe in the Era of Browser-based Cryptocurrency Mining

2018-07-25 17:00:02

Detecting Apache Struts 2 Namespace RCE: CVE-2018-11776

2018-08-23 20:27:19

Microsoft Misfires with Meltdown Patch, while WannaCry Pops Up at Boeing

2018-04-02 18:02:51

alpinelinux

CVE-2018-7600

2018-03-29 07:29:00

thn

Hackers Have Started Exploiting Drupal RCE Exploit Released Yesterday

2018-04-14 08:29:00

Over 115,000 Drupal Sites Still Vulnerable to Drupalgeddon2 Exploit

2018-06-05 08:06:00

Third Critical Drupal Flaw Discovered—Patch Your Sites Immediately

2018-04-25 16:41:00

packetstorm

Drupalgeddon2 Drupal Remote Code Execution

2018-04-17 00:00:00

Drupal Drupalgeddon2 Remote Code Execution Ruby Port

2018-04-13 00:00:00

Drupal Drupalgeddon2 Remote Code Execution

2018-04-13 00:00:00

K22854260 : Drupal vulnerability CVE-2018-7600

2018-03-29 00:00:00

hackerone

U.S. Dept Of Defense: [CVE-2018-7600] Remote Code Execution due to outdated Drupal server on www.█████████

2020-12-21 07:51:14

nvd

CVE-2018-7600

2018-03-29 07:29:00

debian

[SECURITY] [DSA 4156-1] drupal7 security update

2018-03-28 22:31:37

[SECURITY] [DSA 4156-1] drupal7 security update

2018-03-28 22:31:37

[SECURITY] [DLA 1325-1] drupal7 security update

2018-03-28 22:42:25

cve

CVE-2018-7600

2018-03-29 07:29:00

veracode

Remote Code Execution (RCE)

2018-04-03 05:03:22

Remote Code Execution (RCE)

2018-04-26 10:18:46

exploitpack

Drupal 8.3.9 8.4.6 8.5.1 - Drupalgeddon2 Remote Code Execution (PoC)

2018-04-13 00:00:00

Drupal 8.3.9 8.4.6 8.5.1 - Drupalgeddon2 Remote Code Execution (Metasploit)

2018-04-17 00:00:00

Drupal 7.58 8.3.9 8.4.6 8.5.1 - Drupalgeddon2 Remote Code Execution

2018-04-13 00:00:00

debiancve

CVE-2018-7600

2018-03-29 07:29:00

prion

Code injection

2018-03-29 07:29:00

impervablog

Drupalgeddon 2.0: Are Hackers Slacking Off?

2018-04-13 19:13:25

How Imperva’s New Attack Crowdsourcing Secures Your Business’s Applications

2019-02-13 12:52:46

The State of Web Application Vulnerabilities in 2018

2019-01-09 14:00:26

friendsofphp

Highly critical - Remote Code Execution

2018-03-28 19:30:00

Highly critical - Remote Code Execution

2018-03-28 19:30:00

metasploit

Drupal Drupalgeddon 2 Forms API Property Injection

2018-04-18 00:05:45

wallarmlab

Drupalgeddon Two.

2018-04-20 19:31:22

archlinux

[ASA-201804-1] drupal: arbitrary code execution

2018-04-01 00:00:00

cvelist

CVE-2018-7600

2018-03-29 07:00:00

nuclei

Drupal - Remote Code Execution

2021-02-15 13:33:33

ubuntucve

CVE-2018-7600

2018-03-29 00:00:00

seebug

Drupal core Remote Code Execution(CVE-2018-7600) (Drupalgeddon2)

2018-03-30 00:00:00

github

Drupal Core Remote Code Execution Vulnerability

2022-05-14 01:29:45

attackerkb

Drupalgeddon 2

2018-03-29 00:00:00

exploitdb

Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution

2018-04-13 00:00:00

Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC)

2018-04-13 00:00:00

Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)

2018-04-17 00:00:00

githubexploit

Exploit for Improper Input Validation in Drupal

2020-08-31 22:55:18

malwarebytes

A look into Drupalgeddon’s client-side attacks

2018-05-18 15:00:00

hivepro

Muhstik botnet adds another vulnerability exploit to its arsenal

2022-03-29 12:17:03

avleonov

Vulnerability Databases: Classification and Registry

2018-06-05 15:57:41

ubuntu

Drupal vulnerabilities

2021-03-15 00:00:00

kitploit

Darksplitz - Exploit Framework

2019-04-04 21:12:00

Sn1per v5.0 - Automated Pentest Recon Scanner

2018-07-05 13:45:00

Sn1per v6.0 - Automated Pentest Framework For Offensive Security Experts

2018-11-24 12:43:00

securelist

Incident Response Analyst Report 2019

2020-08-06 10:00:34

talosblog

Cisco Talos Honeypot Analysis Reveals Rise in Attacks on Elasticsearch Clusters

2019-02-26 10:56:00

DNS Hijacking Abuses Trust In Core Internet Service

2019-04-18 16:08:25

fedora

[SECURITY] Fedora 27 Update: drupal7-7.59-1.fc27

2018-05-10 19:16:35

[SECURITY] Fedora 27 Update: drupal8-8.4.6-3.fc27

2018-04-24 04:02:47

[SECURITY] Fedora 28 Update: drupal8-8.6.2-1.fc28

2018-12-03 01:39:06

ics

Top 10 Routinely Exploited Vulnerabilities

2020-05-12 12:00:00

Top Routinely Exploited Vulnerabilities

2021-08-20 12:00:00

fireeye

Think Fast: Time Between Disclosure, Patch Release and Vulnerability Exploitation — Intelligence for Vulnerability Management, Part Two

2020-04-13 00:00:00

Solutions

Vulnerabilities intelligence
Perimeter control tool
Linux scanner
Windows scanner
Developers SDK
Security Intelligence feeds

Database

Vulnerabilities
Exploits
Security News
BugBounty
Wild Exploited
Top Vulnerabilities
CVE Feed

Resources

Statics & Sources
Plugins
API docs
FAQ
Blog
Glossary

Company

About
Contacts
Pricing
EULA
Privacy Policy
Submission Policy
OpenSource

@2024 Vulners Inc

8.2 High

AI Score

Confidence

Low

0.976 High

EPSS

Percentile

100.0%

JSON

Related for OSV:GHSA-7FH9-933G-885P