{"action":"Upgrade drupal/core to 8.4.8 or later.","affected":[{"fixed":"8.4.8","introduced":"8.0.0"},{"fixed":"8.5.3","introduced":"8.5.0"}],"component":"drupal/core","cve_ids":["CVE-2018-7602"],"ecosystem":"Packagist","epss":0.99172,"exploited":true,"fixed_versions":["8.4.8","8.5.3"],"ghsa_id":"GHSA-297x-j9pm-xjgg","id":"tcs_01M5KER73TWA7P7M71WB5550J0","modified_at":"2025-12-10T23:41:10.391859Z","published_at":"2018-04-25T16:13:58Z","references":["https://osv.dev/vulnerability/DRUPAL-CORE-2018-004","https://www.drupal.org/sa-core-2018-004"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DRUPAL-CORE-2018-004","url":"https://osv.dev/vulnerability/DRUPAL-CORE-2018-004"},{"source":"kev","source_id":"CVE-2018-7602","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result"}