Exploited in the wild · Drupal core · CVSS 9.8 · published 29 March 2018
Drupalgeddon 2: CVE-2018-7600
A flaw in Drupal's form API that lets an anonymous visitor run code on the server. It affected Drupal 6, 7 and 8. Below: which of the releases we track it affects.
The Drupal versions we track
| Version | CVE-2018-7600 |
|---|---|
| Drupal 7.103 | Not affected |
For the upstream version, according to the US National Vulnerability Database. A distribution package may carry its own fix; the table above shows that.
What the NVD record says
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
Score 9.8 (Critical), published 29 March 2018. Listed in the CISA catalogue of known exploited vulnerabilities on 3 November 2021. Read the NVD entry
Affected upstream versions of Drupal core
- drupal up to 7.57
- drupal from 8.0.0 before 8.3.9
- drupal from 8.4.0 before 8.4.6
- drupal from 8.5.0 before 8.5.1
What you can do
Keep Drupal core, patched
Where the table shows no free fix, we backport it to the package you run, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported release once your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.