CVE-2018-7602
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
- Record
CVE-2018-7602- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
- Record
CVE-2018-7602- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2024-1058
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
- Record
EUVD-2024-1058- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-297x-j9pm-xjgg
Drupal Core Remote Code Execution Vulnerability
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
- Record
GHSA-297x-j9pm-xjgg- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H - Weakness
- CWE-94
- Updated
- 2026-11-02
CISA KEV No score
Drupal Core Remote Code Execution Vulnerability
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
- Record
CVE-2018-7602- Updated
- 2026-11-02
OSV
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
- Record
CVE-2018-7602- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-297x-j9pm-xjgg
Drupal Core Remote Code Execution Vulnerability
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
- Record
GHSA-297x-j9pm-xjgg- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-7602
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
- Record
UBUNTU-CVE-2018-7602- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDRUPAL-CORE-2018-004 No score
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
Updated — this vulnerability is being exploited in the wild.
- Record
DRUPAL-CORE-2018-004- Updated
- 2026-11-02
OSVUSN-4773-1 No score
drupal7 vulnerabilities
It was discovered that Drupal did not properly process certain input. An attacker could use this vulnerability to execute arbitrary code or completely compromise a Drupal site. (CVE-2018-7600, CVE-2018-7602)
It was discovered that password reset URLs in Drupal could be forged. An attacker could use this vulnerability to gain access to another user's account. This issue affected only Ubuntu 14.04 ESM. (CVE-2015-2559)
It was discovered that Drupal did not properly protect against open redirects. An attacker could use this vulnerability to send unsuspecting users to 3rd party sites and potentially carry out phishing attacks. This issue affected only Ubuntu 14.04 ESM. (CVE-2015-2749, CVE-2015-2750)
- Record
USN-4773-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/corePackagist |
7.0 up to 7.59 | 7.59 |
drupal/corePackagist |
8.0 up to 8.4.8 | 8.4.8 |
drupal/corePackagist |
8.5 up to 8.5.3 | 8.5.3 |
drupal/drupalPackagist |
7.0 up to 7.59 | 7.59 |
drupal/drupalPackagist |
8.0 up to 8.4.8 | 8.4.8 |
drupal/drupalPackagist |
8.5 up to 8.5.3 | 8.5.3 |
drupal7Debian:7 |
before 7.14-2+deb7u19, plus listed versions 7.14-27.14-2+deb7u17.14-2+deb7u107.14-2+deb7u10~bpo60+17.14-2+deb7u11 Show 22 moreShow less7.14-2+deb7u11~bpo60+17.14-2+deb7u127.14-2+deb7u137.14-2+deb7u147.14-2+deb7u157.14-2+deb7u167.14-2+deb7u177.14-2+deb7u187.14-2+deb7u1~bpo60+17.14-2+deb7u27.14-2+deb7u2~bpo60+17.14-2+deb7u37.14-2+deb7u47.14-2+deb7u4~bpo60+17.14-2+deb7u57.14-2+deb7u67.14-2+deb7u6~bpo60+17.14-2+deb7u77.14-2+deb7u7~bpo60+17.14-2+deb7u87.14-2+deb7u97.14-2+deb7u9~bpo60+1 |
7.14-2+deb7u19 |
drupal/corePackagist |
8.0.0 up to 8.4.8, 8.5.0 up to 8.5.3, plus listed versions 8.0.18.0.28.0.38.0.48.0.5 Show 45 moreShow less8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1 |
8.4.88.5.3 |
drupal7Debian:8 |
before 7.32-1+deb8u12, plus listed versions 7.32-1+deb8u107.32-1+deb8u117.32-1+deb8u37.32-1+deb8u47.32-1+deb8u4~bpo70+1 Show 6 moreShow less7.32-1+deb8u57.32-1+deb8u5~bpo70+17.32-1+deb8u67.32-1+deb8u77.32-1+deb8u87.32-1+deb8u9 |
7.32-1+deb8u12 |
drupal7Debian:9 |
before 7.52-2+deb9u4, plus listed versions 7.52-27.52-2+deb9u17.52-2+deb9u27.52-2+deb9u3 |
7.52-2+deb9u4 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
drupal/corePackagist |
8.0 up to 8.4.8, plus listed versions 8.0.08.0.0-beta108.0.0-beta118.0.0-beta128.0.0-beta13 Show 45 moreShow less8.0.0-beta148.0.0-beta158.0.0-beta168.0.0-beta68.0.0-beta78.0.0-beta88.0.0-beta98.0.0-rc18.0.0-rc28.0.0-rc38.0.0-rc48.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.8 |
8.4.8 |
drupal/corePackagist |
8.5 up to 8.5.3, plus listed versions 8.5.08.5.0-alpha18.5.0-beta18.5.0-rc18.5.18.5.2 |
8.5.3 |
drupal/drupalPackagist |
8.0 up to 8.4.8, plus listed versions 8.0.08.0.0-alpha148.0.0-alpha158.0.0-beta18.0.0-beta10 Show 45 moreShow less8.0.0-beta118.0.0-beta128.0.0-beta138.0.0-beta148.0.0-beta158.0.0-beta168.0.0-beta28.0.0-beta38.0.0-beta48.0.0-beta58.0.0-beta68.0.0-beta78.0.0-beta98.0.0-rc18.0.0-rc28.0.0-rc38.0.0-rc48.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.2 |
8.4.8 |
drupal/drupalPackagist |
8.5 up to 8.5.3, plus listed versions 8.5.08.5.0-alpha18.5.0-beta18.5.0-rc18.5.18.5.2 |
8.5.3 |
drupal7Ubuntu:Pro:14.04:LTS |
before 7.26-1ubuntu0.1+esm1, plus listed versions 7.23-17.24-17.24-27.26-17.26-1ubuntu0.1 |
7.26-1ubuntu0.1+esm1 |
drupal7Ubuntu:Pro:16.04:LTS |
before 7.44-1ubuntu1~16.04.0+esm1, plus listed versions 7.38-17.41-17.44-1ubuntu1~16.04.0 |
7.44-1ubuntu1~16.04.0+esm1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC) | 2018-04-25 |
| PoC in GitHub | 1337g/Drupalgedon3 | 2018-04-27 |
| Exploit-DB | Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code (Metasploit) | 2018-04-30 |
| PoC in GitHub | happynote3966/CVE-2018-7602 | 2018-07-12 |
| PoC in GitHub | kastellanos/CVE-2018-7602 | 2018-10-29 |
| PoC in GitHub | cyberharsh/DrupalCVE-2018-7602 | 2020-06-25 |
| PoC in GitHub | 132231g/CVE-2018-7602 | 2024-02-18 |
| Nuclei | Drupal - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-7602 is a critical vulnerability (CVSS 9.8) in Drupal Core, published April 25, 2018. CISA lists it as known to be exploited, since April 13, 2022. EUVD reports exploitation since April 13, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.2%, the 99th percentile. Fixed in drupal/core 7.59.
References
exploit-db.com/exploits/44557
securitytracker.com/id/1040754
lists.debian.org/debian-lts-announce/2018/04/msg00030.html
debian.org/security/2018/dsa-4180
drupal.org/sa-core-2018-004
Show 16 moreShow less
securityfocus.com/bid/103985
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602
nvd.nist.gov/vuln/detail/CVE-2018-7602
github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7602.yaml
ubuntu.com/security/CVE-2018-7602
cve.org/CVERecord?id=CVE-2018-7602
Left out here: 70 versions. The JSON record has them.