Drupal Core Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 13/04/2022. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/core | ≥ 7.0, < 7.59≥ 8.0, < 8.4.8≥ 8.0.0, < 8.4.8≥ 8.5, < 8.5.3≥ 8.5.0, < 8.5.3 | 7.598.4.88.5.3 |
| drupal/drupal | ≥ 7.0, < 7.59≥ 8.0, < 8.4.8≥ 8.5, < 8.5.3 | 7.598.4.88.5.3 |
| drupal | ≥ 7.0, < 7.59≥ 8.4.0, < 8.4.8≥ 8.5.0, < 8.5.3 | 7.598.4.88.5.3 |
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free