{"id":"CVE-2018-7602","revision":"8562aecef6224099827d52b7b883e628","records":[{"revision":"8562aecef6224099827d52b7b883e628","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2018-7602","aliases":[],"title":"Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004","description":"A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.","state":0,"publishedAt":"2018-07-19T17:00:00+00:00","modifiedAt":"2026-10-01T20:28:55.11+00:00","affected":[{"ecosystem":"Vendor product","name":"core","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"core\",\n                    \"vendor\": \"Drupal\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"7.59\",\n                            \"status\": \"affected\",\n                            \"version\": \"unspecified\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"lessThan\": \"8.5.3\",\n                            \"status\": \"affected\",\n                            \"version\": \"unspecified\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"lessThan\": \"8.4.8\",\n                            \"status\": \"affected\",\n                            \"version\": \"unspecified\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://www.exploit-db.com/exploits/44557/","http://www.securitytracker.com/id/1040754","https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html","https://www.exploit-db.com/exploits/44542/","https://www.debian.org/security/2018/dsa-4180","https://www.drupal.org/sa-core-2018-004","http://www.securityfocus.com/bid/103985"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2018-7602","license":"CVE Program Terms of Use","key":"cve-program:CVE-2018-7602","identifiers":["CVE-2018-7602"]},"retained":false,"historicalAffected":[]}],"coverage":[]}