جزئیات آسیب‌پذیری

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

• https://github.com/g0rx/CVE-2018-7600-Drupal-RCE x_refsource_MISC
• http://www.securitytracker.com/id/1040598 vdb-entryx_refsource_SECTRACK
• https://twitter.com/arancaytar/status/979090719003627521 x_refsource_MISC
• https://twitter.com/RicterZ/status/979567469726613504 x_refsource_MISC
• https://www.drupal.org/sa-core-2018-002 x_refsource_CONFIRM
• https://www.synology.com/support/security/Synology_SA_18_17 x_refsource_CONFIRM
• https://github.com/a2u/CVE-2018-7600 x_refsource_MISC
• https://www.exploit-db.com/exploits/44482/ exploitx_refsource_EXPLOIT-DB
• https://research.checkpoint.com/uncovering-drupalgeddon-2/ x_refsource_MISC
• https://groups.drupal.org/security/faq-2018-002 x_refsource_CONFIRM
• https://www.debian.org/security/2018/dsa-4156 vendor-advisoryx_refsource_DEBIAN
• https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html mailing-listx_refsource_MLIST
• https://www.exploit-db.com/exploits/44448/ exploitx_refsource_EXPLOIT-DB
• http://www.securityfocus.com/bid/103534 vdb-entryx_refsource_BID
• https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/ x_refsource_MISC
• https://greysec.net/showthread.php?tid=2912&pid=10561 x_refsource_MISC
• https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714 x_refsource_MISC
• https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know x_refsource_MISC
• https://twitter.com/RicterZ/status/984495201354854401 x_refsource_MISC
• https://www.exploit-db.com/exploits/44449/ exploitx_refsource_EXPLOIT-DB
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600 government-resource