CVE-2018-7602

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 2, 2026

Description

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Drupal	core	>= unspecified, < 7.59; >= unspecified, < 8.5.3; >= unspecified, < 8.4.8

References

http://www.securityfocus.com/bid/103985Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040754Broken Link, Third Party Advisory, VDB Entry
https://lists.debian.org/debian-lts-announce/2018/04/msg00030.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2018/dsa-4180Third Party Advisory
https://www.drupal.org/sa-core-2018-004Patch, Vendor Advisory
https://www.exploit-db.com/exploits/44542/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/44557/Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/103985Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040754Broken Link, Third Party Advisory, VDB Entry
https://lists.debian.org/debian-lts-announce/2018/04/msg00030.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2018/dsa-4180Third Party Advisory
https://www.drupal.org/sa-core-2018-004Patch, Vendor Advisory
https://www.exploit-db.com/exploits/44542/Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/44557/Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602US Government Resource

Timeline

Published: Jul 19, 2018
Last modified: Oct 2, 2026
Added to CISA KEV: Apr 13, 2022
NVD status: Analyzed

Related CVEs from 2018

CVE-2018-76036.1In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autoc CVE-2018-76319.8Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attackers to execute code remotely via a specially crafted GET request without a leadi CVE-2018-76327.5Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attackers to cause a denial of service attack remotely via a specially crafted GET req CVE-2018-76339.8Code injection in the /ui/login form Language parameter in Epicentro E_7.3.2+ allows attackers to execute JavaScript code by making a user i CVE-2018-76348.8An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF attack mitigation while changing an e-mail address makes it possible to abuse t CVE-2018-76355.3Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser's address bar when visiting a blank CVE-2018-76366.1The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScript or HTML via speci CVE-2018-76377.8An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a differ CVE-2018-76387.8An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a differ CVE-2018-76397.8An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a differ CVE-2018-76407.8An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a differ CVE-2018-76417.8An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted bmp image, a differ