SECURELYN
Free ScanFree consultation

Drupal (CVE-2018-7600)

CVE-2018-7600 is a published vulnerability record for Drupal. This draft does not describe the flaw yet. A Securelyn engineer adds the verified description, affected versions and fixed release from the vendor and NVD pages before the advisory goes live.

Check if you are exposedTalk to an expert

Who should care

Anyone who runs Drupal on a website, server or network they are responsible for, and anyone who pays a provider to run it for them. Our exposure check can recognise Drupal from public signals on a website, so you can use it to find out.

What to do

  1. Find out whether you run Drupal, and which version. Ask your web developer or hosting provider if you are not sure.
  2. Read the vendor's advisory for CVE-2018-7600 and note the fixed release. The NVD record under References links to the vendor's page.
  3. Update to the fixed release or a later one. If you cannot update now, ask your provider which workarounds the vendor documents.
  4. Check the CISA catalogue under References to see whether CVE-2018-7600 is listed as exploited. If it is, treat the update as urgent.
  5. Run the exposure check on this page again once you have updated.

What is affected

Affected versions are not recorded in our offline sample. Read the vendor's advisory for CVE-2018-7600 to see which Drupal versions are affected and which release fixes them.

Is it being exploited?

CISA KEV
Not in our offline sample: check the CISA catalogue.
EPSS
Not in our offline sample: check the CISA catalogue.

Severity and technical details

Fixed in
  • 8.3.9
  • 8.4.6
  • 8.5.1
  • 7.58
Also known as
  • GHSA-7fh9-933g-885p
Fixed versions and aliases from
OSV.dev open-source vulnerability database

References