CVE-2018-7602

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

• CWE-94

• http://www.securityfocus.com/bid/103985Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040754Broken Link, Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2018/04/msg00030.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2018/dsa-4180Third Party Advisory
• https://www.drupal.org/sa-core-2018-004Patch, Vendor Advisory
• https://www.exploit-db.com/exploits/44542/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/44557/Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/103985Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040754Broken Link, Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2018/04/msg00030.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2018/dsa-4180Third Party Advisory
• https://www.drupal.org/sa-core-2018-004Patch, Vendor Advisory
• https://www.exploit-db.com/exploits/44542/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/44557/Exploit, Third Party Advisory, VDB Entry
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602US Government Resource

Published

Jul 19, 2018

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7586In the nextgen-gallery plugin before 2.2.50 for WordPress, g…
• CVE-2018-7587An issue was discovered in CImg v.220. DoS occurs when loadi…
• CVE-2018-7588An issue was discovered in CImg v.220. A heap-based buffer o…
• CVE-2018-7589An issue was discovered in CImg v.220. A double free in load…
• CVE-2018-7590CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulti…
• CVE-2018-7600Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, an…9.8
• CVE-2018-7603In Drupal's 3rd party module search auto complete prior to v…
• CVE-2018-7631Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attack…
• CVE-2018-7632Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attack…
• CVE-2018-7633Code injection in the /ui/login form Language parameter in E…
• CVE-2018-7634An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF…
• CVE-2018-7635Whale Browser before 1.0.41.8 displays no URL information bu…