CVE-2018-7602: Drupal Core Remote Code Execution
CVE-2018-7602 is a critical remote code execution flaw in multiple subsystems of Drupal core, classified as code injection (CWE-94). The record states it is linked to SA-CORE-2018-002 and is listed in the CISA KEV catalog as exploited. Fixed versions and defensive steps are described below.
Overview
CVE-2018-7602 is a remote code execution vulnerability (CWE-94, Code Injection) affecting several subsystems of Drupal core in the 7.x and 8.x lines. The record links it to Drupal security advisory SA-CORE-2018-002 and points to fix guidance in SA-CORE-2018-004.
Impact
According to the record, an attacker could use multiple attack vectors against a Drupal site, which could result in the site being compromised. The NVD CVSS 3.1 base score is 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network reachability, no privileges or user interaction required, and high impact on confidentiality, integrity and availability.
Affected products and versions
- Drupal Core: versions below 7.59, below 8.5.3 and below 8.4.8, as listed in the record.
- Drupal Drupal: 7.0 up to 7.59, 8.4.0 up to 8.4.8, and 8.5.0 up to 8.5.3, as listed in the record.
- Debian Linux: the record lists Debian Debian Linux versions 7.0, 8.0 and 9.0 as affected, referencing DSA-4180.
Exploitation status
The CISA Known Exploited Vulnerabilities catalog lists this CVE with date added 2022-04-13, due date 2022-05-04, and ransomware use recorded as Known. The record also states it is being exploited in the wild. The record includes an SSVC exploitation value of active and an EPSS probability of 0.99172 as recorded. Public exploit entries are listed among the references; their contents are not reproduced here.
Remediation and mitigation
- Upgrade Drupal core to a fixed version for the affected branch: 7.59 or later on the 7.x line, 8.4.8 or later on the 8.4 line, and 8.5.3 or later on the 8.5 line, following the Drupal advisory.
- Apply the Debian distribution updates referenced by DSA-4180 where Debian packages are in use.
- Because the vulnerability is confirmed as exploited, prioritize these updates and review systems for signs of compromise before and after patching.
- Follow the KEV required action: apply updates per vendor instructions.
Detection guidance
- Review web server and application logs for unusual requests to Drupal endpoints in the period before patching.
- Check for unexpected files, new administrative accounts or modified site content, which may indicate compromise.
- Monitor the Drupal version in use across the estate to confirm that no instance remains below the fixed versions.
Limitations of the available information
The record does not provide the full technical details of the vulnerable subsystems. It links the flaw to SA-CORE-2018-002 but the fix reference is SA-CORE-2018-004, and the sources consulted do not explain this difference. The record does not specify which Debian package versions contain fixes. Several reference links are marked as broken in the record, and the EPSS date in the record is outside the typical range for this data, so it should be checked against the source.
Frequently asked questions
Is CVE-2018-7602 being exploited?
Yes. The CISA KEV catalog lists it, with ransomware use recorded as Known, and the record states it is being exploited in the wild.
Which Drupal versions are fixed?
According to the record, the fixed versions are 7.59 or later on the 7.x line, 8.4.8 or later on the 8.4 line, and 8.5.3 or later on the 8.5 line.
What should administrators do first?
Upgrade Drupal core to a fixed version for each affected branch, apply Debian updates where relevant, and review systems for signs of compromise.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.