Vulnerability advisory

CVE-2018-7600

Published Mar 29, 2018Updated Oct 24, 2026OSV record ↗

Also known as DRUPAL-CORE-2018-002GHSA-7fh9-933g-885p

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
All commits through bc929eb17c4f4eea83cb796b7c5bbb984bf288bd	No fix listed
35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before ca315ad868680ff1d5686a07fc326eb116816049	`ca315ad868680ff1d5686a07fc326eb116816049`
abfe77673a5a6194ef13600e05f1ca2c5dd59db8 to before 6424f69db19adbf6b21832ab4973d07165ee86ad	`6424f69db19adbf6b21832ab4973d07165ee86ad`
b73ab73d39dca97a12513e8a9e4f4da4b0676f5f to before 9798f28fe983bea94fb06ff52423355688066780	`9798f28fe983bea94fb06ff52423355688066780`
Also listed as affected (83) `7.57` `8.3.8` `8.4.5` `8.5.0` `7.56` `8.4.4` `8.4.3` `8.4.1` `8.4.0` `8.3.6` `8.3.5` `8.3.3` `7.55` `8.3.2` `8.3.0` `8.3.0-rc2` `8.3.0-rc1` `8.3.0-beta1` `7.54` `8.3.0-alpha1` `7.51` `7.50` `7.43` `8.1.0-beta1` `7.42` `8.0.0` `7.40` `7.37` `7.36` `7.33` `7.30` `7.28` `7.25` `7.23` `7.22` `7.17` `7.15` `7.14` `7.12` `7.10` `7.9` `7.8` `7.7` `7.6` `7.4` `7.0` `7.0-rc-4` `7.0-rc-3` `7.0-rc-2` `7.0-rc-1` `7.0-beta3` `7.0-beta2` `7.0-beta1` `7.0-alpha7` `7.0-alpha6` `7.0-alpha5` `7.0-alpha4` `7.0-alpha3` `7.0-alpha2` `7.0-alpha1` `7.0-unstable-10` `7.0-unstable-7` `7.0-unstable-6` `7.0-unstable-5` `7.0-unstable-4` `7.0-unstable-3` `7.0-unstable-2` `7.0-unstable-1` `6.0-rc-3` `6.0-rc-2` `6.0-rc-1` `6.0-beta-4` `6.0-beta-3` `6.0-beta-2` `6.0-beta-1` `5.0-rc-2` `5.0-rc-1` `5.0-beta-2` `5.0-beta-1` `3.0.1` `2.0` `1.0` `start`

Description

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

CVE-2018-7600

Affected versions

Repository

Description

References