Packagist/drupal/core CVE-2018-7602: unknown, exploited, EPSS 99.17%

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result

Action: Upgrade drupal/core to 8.4.8 or later.

composer require drupal/core:8.4.8

composer require drupal/core:8.5.3

Affected

introduced	fixed	last affected
8.0.0	8.4.8	-
8.5.0	8.5.3	-

Fixed versions

8.4.8

8.5.3

Sources

osv: DRUPAL-CORE-2018-004
kev: CVE-2018-7602
https://www.drupal.org/sa-core-2018-004

CVE-2018-7602 · published 2018-04-25T16:13:58Z · modified 2025-12-10T23:41:10.391859Z · JSON