Drupalgeddon continues with one more remote code execution bug has been discovered in content management system. Identified as CVE-2018-7602, the highly critical vulnerability affects Drupal versions 7.x and 8.x. Affected users should immediately upgrade to Drupal v7.59 and 8.5.3. The bug is actively exploited in the wild, the Drupal team said, so don’t waste any time and patch.
Official Description of CVE-2018-7602
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x, the Drupal security team recently announced. This allows attackers to exploit multiple attack vectors on a site running on Drupal, which could result in the site being compromised in various ways. Note that CVE-2018-7602 is related to Drupal core – Highly critical – Remote Code Execution – SA-CORE-2018-002.
Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild, Drupal said. In addition, if admins are having issues implementing the update, they should proceed with applying standalone patches. However, before proceeding admins have to apply the fix from SA-CORE-2018-002 from March 28, 2018. Websites without this patch may have already been compromised.
Drupal Vulnerabilities CVE-2018-7602 and CVE-2018-7600
Earlier this month, another highly critical Drupal bug was discovered – CVE-2018-7600, which is very similar to CVE-2018-7602.
CVE-2018-7600 is also a remote code execution vulnerability existing within multiple subsystems of Drupal 7.x and 8.x. The bug allows attackers to exploit multiple attack vectors on a Drupal site. More specifically, the highly critical bug could cause severe damage to a website which could be hacked via remote code execution due to a missing input validation.
This flaw was quickly addressed, but it didn’t take long for attackers to develop an exploit after the fixed for it (Read more...)
*** This is a Security Bloggers Network syndicated blog from How to, Technology and PC Security Forum authored by Milena Dimitrova. Read the original post at: https://sensorstechforum.com/cve-2018-7602-drupal-bug-exploited/