Risk Score
9.8
Out of 10
Summary
Identifier
CVE-2018-7600
Description
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
MergeBase Comment
The forms feature in Drupal allows you to inject properties through an unintentional effect of the "Renderable Arrays" feature.
A Malicious user can inject a payload into a vulnerable AJAX form which can achieve remote code execution if they can successfully POST to a vulnerable form endpoint. This exploit is very simple, and scriptable payloads are available on public exploit databases. If any of your public servers are vulnerable to this exploit, automated exploit systems will likely attempt to gain access.
For more information, see the following research.
Vulnerability Fixed in: 7.58, 8.3.9, 8.4.6, 8.5.1
Common Weakness Enumeration (CWE)
