CVE-2018-7602

描述

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

如何修補 CVE-2018-7602

要修補 CVE-2018-7602,請將受影響套件升級到下列已修補版本。

• —升級至 7.14-2+deb7u19 或更新版本
• —升級至 7.32-1+deb8u12 或更新版本
• —升級至 8.4.8 或更新版本
• —升級至 7.59 或更新版本
• —升級至 7.59 或更新版本

CVE-2018-7602 正在被利用嗎?

是 — CVE-2018-7602 已列入 CISA Known Exploited Vulnerabilities (KEV) 清單,代表正在被實際利用,請立即修補。

受影響套件(5)

• from 0, < 7.14-2+deb7u19
• from 0, < 7.32-1+deb8u12
• >= 8.0.0, < 8.4.8 | >= 8.5.0, < 8.5.3
• >= 7.0, < 7.59
• >= 7.0, < 7.59

CVSS 分數

參考連結(10)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-7602
• PATCHgithub.com/drupal/core
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7602.yaml
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7602.yaml