CVE-2018-7600, also known as "Drupalgeddon2," is a critical remote code execution vulnerability affecting Drupal versions before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1. This flaw allows unauthenticated attackers to execute arbitrary code on vulnerable Drupal installations due to issues in multiple subsystems, even with default or common module configurations. With a CVSS score of 9.8 (CRITICAL), it presents a severe risk, enabling complete compromise of confidentiality, integrity, and availability. This vulnerability is actively exploited, listed in CISA's KEV catalog, and has publicly available exploit modules in Metasploit and Nuclei, along with extensive community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 7.57CPE matchmatch criteria | cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* | ||
>= 8.0.0, < 8.3.9CPE matchmatch criteria | cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* | ||
>= 8.4.0, < 8.4.6CPE matchmatch criteria | cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* | ||
>= 8.5.0, < 8.5.1CPE matchmatch criteria | cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.