{"id":"CVE-2018-7600","published":"2018-03-29T07:29:00Z","modified":"2026-06-17T02:03:25Z","title":"Drupal Core Remote Code Execution Vulnerability","vendor":"Drupal","product":"Drupal Core","tier":"core","eol":null,"description":{"text":"Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.","provenance":"source","from":"NVD"},"summary":{"text":"Drupal Core contains a flaw in multiple subsystems affecting versions before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1, classed as improper input validation. A remote attacker with no authentication or user interaction can execute arbitrary code on the affected site when default or common module configurations are in use.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:55:07Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99991,"percentile":0.99985,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-7600","provenance":"source"},"vulncheckKev":{"dateAdded":"2018-04-20","exploitedFirstSeen":"2018-04-20","ransomware":true,"evidence":[{"url":"https://blog.netlab.360.com/botnet-muhstik-is-actively-exploiting-drupal-cve-2018-7600-in-a-worm-style-en/","date":"2018-04-20"},{"url":"https://cert.gov.ua/article/2725","date":"2018-04-26"},{"url":"https://blog.talosintelligence.com/2019/04/seaturtle.html","date":"2019-04-17"},{"url":"https://www.alibabacloud.com/blog/8220-mining-group-now-uses-rootkit-to-hide-its-miners_595055","date":"2019-07-08"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities--exploits--and-malware-driving-attack-campaigns-in-july-2019","date":"2019-08-28"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities--exploits--and-malware-driving-attack-campaigns-in-december-2019","date":"2020-01-31"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-133a","date":"2020-05-12"},{"url":"https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/","date":"2020-06-24"},{"url":"https://research.checkpoint.com/2020/rudeminer-blacksquid-and-lucifer-walk-into-a-bar/","date":"2020-09-15"},{"url":"https://know.netenrich.com/blog/ragnar-locker-petya-and-ryuk-know-your-ransomware/","date":"2020-10-01"}],"evidenceTotal":995,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://www.securityfocus.com/bid/103534","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040598","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/","tags":["Broken Link","Third Party Advisory"]},{"url":"https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714","tags":["Third Party Advisory"]},{"url":"https://github.com/a2u/CVE-2018-7600","tags":["Third Party Advisory"]},{"url":"https://github.com/g0rx/CVE-2018-7600-Drupal-RCE","tags":["Patch","Third Party Advisory"]},{"url":"https://greysec.net/showthread.php?tid=2912&pid=10561","tags":["Broken Link","Issue Tracking","Third Party Advisory"]},{"url":"https://groups.drupal.org/security/faq-2018-002","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html","tags":["Third Party Advisory"]},{"url":"https://research.checkpoint.com/uncovering-drupalgeddon-2/","tags":["Exploit","Third Party Advisory"]},{"url":"https://twitter.com/RicterZ/status/979567469726613504","tags":["Broken Link","Third Party Advisory"]},{"url":"https://twitter.com/RicterZ/status/984495201354854401","tags":["Broken Link","Third Party Advisory"]},{"url":"https://twitter.com/arancaytar/status/979090719003627521","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4156","tags":["Third Party Advisory"]},{"url":"https://www.drupal.org/sa-core-2018-002","tags":["Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/44448/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/44449/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/44482/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.synology.com/support/security/Synology_SA_18_17","tags":["Third Party Advisory"]},{"url":"https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know","tags":["Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/103534","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040598","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600/","tags":["Broken Link","Third Party Advisory"]},{"url":"https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714","tags":["Third Party Advisory"]},{"url":"https://github.com/a2u/CVE-2018-7600","tags":["Third Party Advisory"]},{"url":"https://github.com/g0rx/CVE-2018-7600-Drupal-RCE","tags":["Patch","Third Party Advisory"]},{"url":"https://greysec.net/showthread.php?tid=2912&pid=10561","tags":["Broken Link","Issue Tracking","Third Party Advisory"]},{"url":"https://groups.drupal.org/security/faq-2018-002","tags":["Vendor Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html","tags":["Third Party Advisory"]},{"url":"https://research.checkpoint.com/uncovering-drupalgeddon-2/","tags":["Exploit","Third Party Advisory"]},{"url":"https://twitter.com/RicterZ/status/979567469726613504","tags":["Broken Link","Third Party Advisory"]},{"url":"https://twitter.com/RicterZ/status/984495201354854401","tags":["Broken Link","Third Party Advisory"]},{"url":"https://twitter.com/arancaytar/status/979090719003627521","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4156","tags":["Third Party Advisory"]},{"url":"https://www.drupal.org/sa-core-2018-002","tags":["Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/44448/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/44449/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/44482/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.synology.com/support/security/Synology_SA_18_17","tags":["Third Party Advisory"]},{"url":"https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7600","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev","ctid-cve"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution; CTID attack_to_cve (Phase 1)","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2018-7602 is a remote code execution (RCE) vulnerability affecting Drupal’s versions 7 and 8. According to reports, successfully exploiting the vulnerability entails elevating the permission to modify or delete the content of a Drupal-run site and crypto-jacking campaigns.\n\n","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":"CVE-2018-7602 is a remote code execution (RCE) vulnerability affecting Drupal’s versions 7 and 8. According to reports, successfully exploiting the vulnerability entails elevating the permission to modify or delete the content of a Drupal-run site and crypto-jacking campaigns.\n\n","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1485","name":"Data Destruction","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2018-7602 is a remote code execution (RCE) vulnerability affecting Drupal’s versions 7 and 8. According to reports, successfully exploiting the vulnerability entails elevating the permission to modify or delete the content of a Drupal-run site and crypto-jacking campaigns.\n\n","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1496","name":"Resource Hijacking","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2018-7602 is a remote code execution (RCE) vulnerability affecting Drupal’s versions 7 and 8. According to reports, successfully exploiting the vulnerability entails elevating the permission to modify or delete the content of a Drupal-run site and crypto-jacking campaigns.\n\n","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"}],"reports":[{"id":"SRC-65ab06ae92274f14e50e","title":"DNS Hijacking Abuses Trust In Core Internet Service","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/seaturtle/","date":"2019-04-17","mentions":[{"quote":"CVE-2018-7600: RCE for Website built with Drupal, aka \"Drupalgeddon\"","start":9098,"end":9166},{"quote":"Service Router 2811SID: 43424 - 43432CVE-2017-12617: RCE affecting Apache web servers running TomcatSID: 44531CVE-2018-0296: Directory traversal to gain unauthorized access to Cisco Adaptive Security Appliances (ASAs) and FirewallsSID: 46897CVE-2018-7600: RCE for Website built with Drupal aka \"Drupalgeddon\"SID:","start":20396,"end":20708}]}],"affected":[{"ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=7.0, <7.58",">=8.0, <8.3.9",">=8.4.0, <8.4.6",">=8.5.0, <8.5.1",">=8.0.0, <8.3.9"],"patched":["7.58","8.3.9","8.4.6","8.5.1"],"from":["GHSA-7fh9-933g-885p","DRUPAL-CORE-2018-002"],"provenance":"source"},{"ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=7.0, <7.58",">=8.0, <8.3.9",">=8.4, <8.4.6",">=8.5, <8.5.1"],"patched":["7.58","8.3.9","8.4.6","8.5.1"],"from":["GHSA-7fh9-933g-885p"],"provenance":"source"}],"advisories":[{"id":"GHSA-7fh9-933g-885p","url":"https://github.com/advisories/GHSA-7fh9-933g-885p","severity":"CRITICAL","ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=7.0, <7.58"],"patched":["7.58"],"provenance":"source","from":"GHSA"},{"id":"GHSA-7fh9-933g-885p","url":"https://github.com/advisories/GHSA-7fh9-933g-885p","severity":"CRITICAL","ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.0, <8.3.9"],"patched":["8.3.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-7fh9-933g-885p","url":"https://github.com/advisories/GHSA-7fh9-933g-885p","severity":"CRITICAL","ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.4.0, <8.4.6"],"patched":["8.4.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-7fh9-933g-885p","url":"https://github.com/advisories/GHSA-7fh9-933g-885p","severity":"CRITICAL","ecosystem":"Packagist","package":"drupal/core","vulnerableRanges":[">=8.5.0, <8.5.1"],"patched":["8.5.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-7fh9-933g-885p","url":"https://github.com/advisories/GHSA-7fh9-933g-885p","severity":"CRITICAL","ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=7.0, <7.58"],"patched":["7.58"],"provenance":"source","from":"GHSA"},{"id":"GHSA-7fh9-933g-885p","url":"https://github.com/advisories/GHSA-7fh9-933g-885p","severity":"CRITICAL","ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=8.0, <8.3.9"],"patched":["8.3.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-7fh9-933g-885p","url":"https://github.com/advisories/GHSA-7fh9-933g-885p","severity":"CRITICAL","ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=8.4, <8.4.6"],"patched":["8.4.6"],"provenance":"source","from":"GHSA"},{"id":"GHSA-7fh9-933g-885p","url":"https://github.com/advisories/GHSA-7fh9-933g-885p","severity":"CRITICAL","ecosystem":"Packagist","package":"drupal/drupal","vulnerableRanges":[">=8.5, <8.5.1"],"patched":["8.5.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-2985","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2985","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":44448,"url":"https://www.exploit-db.com/exploits/44448","title":"Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC)","type":"webapps","platform":"php","date":"2018-04-13","verified":true,"provenance":"source"},{"id":44449,"url":"https://www.exploit-db.com/exploits/44449","title":"Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution","type":"webapps","platform":"php","date":"2018-04-13","verified":true,"provenance":"source"},{"id":44482,"url":"https://www.exploit-db.com/exploits/44482","title":"Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)","type":"remote","platform":"php","date":"2018-04-17","verified":true,"provenance":"source"},{"id":44482,"url":"https://www.exploit-db.com/exploits/44482","title":"Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)","type":"remote","platform":"php","date":"2018-04-17","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2018-04-13"},"pocGithub":{"count":47,"skipped":9,"earliest":"2018-03-30","earliestUrl":"https://github.com/g0rx/CVE-2018-7600-Drupal-RCE","repos":[{"name":"dreadlocked/Drupalgeddon2","url":"https://github.com/dreadlocked/Drupalgeddon2","stars":600,"created":"2018-04-12"},{"name":"a2u/CVE-2018-7600","url":"https://github.com/a2u/CVE-2018-7600","stars":353,"created":"2018-03-30"},{"name":"pimps/CVE-2018-7600","url":"https://github.com/pimps/CVE-2018-7600","stars":141,"created":"2018-04-17"},{"name":"g0rx/CVE-2018-7600-Drupal-RCE","url":"https://github.com/g0rx/CVE-2018-7600-Drupal-RCE","stars":113,"created":"2018-03-30"},{"name":"firefart/CVE-2018-7600","url":"https://github.com/firefart/CVE-2018-7600","stars":71,"created":"2018-04-16"}]},"metasploit":[{"name":"Drupal Drupalgeddon 2 Forms API Property Injection","module":"exploit/unix/webapp/drupal_drupalgeddon2","type":"exploit","disclosureDate":"2018-03-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/drupal_drupalgeddon2.rb"}],"nuclei":[{"id":"CVE-2018-7600","name":"Drupal - Remote Code Execution","severity":"critical","path":"http/cves/2018/CVE-2018-7600.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7600.yaml"}],"first":{"date":"2018-03-28","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/drupal_drupalgeddon2.rb"},"provenance":"source"},"exploitRefs":["https://research.checkpoint.com/uncovering-drupalgeddon-2/","https://www.exploit-db.com/exploits/44448/","https://www.exploit-db.com/exploits/44449/","https://www.exploit-db.com/exploits/44482/","https://www.exploit-db.com/exploits/44482","https://www.exploit-db.com/exploits/44449","https://www.exploit-db.com/exploits/44448"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1485","T1496"],"provenance":"source"}],"timeline":[{"date":"2018-03-28","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2018-03-30, Exploit-DB 2018-04-13","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/drupal_drupalgeddon2.rb","provenance":"source"},{"date":"2018-03-29","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7600","provenance":"source"},{"date":"2018-04-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.netlab.360.com/botnet-muhstik-is-actively-exploiting-drupal-cve-2018-7600-in-a-worm-style-en/","provenance":"source"},{"date":"2019-04-17","kind":"report","label":"Named in blog.talosintelligence.com: DNS Hijacking Abuses Trust In Core Internet Service","url":"https://blog.talosintelligence.com/seaturtle/","provenance":"machine"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2985","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":1315},"priority":{"score":83.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3115 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"4 NVD references tagged Exploit; 4 Exploit-DB entries; 3 advisory exploit references; 47 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2017-6927","published":"2018-03-01","fixed":"8.4.5","kev":false},{"cve":"CVE-2017-6930","published":"2018-03-01","fixed":"8.4.5","kev":false},{"cve":"CVE-2017-6931","published":"2018-03-01","fixed":"8.4.5","kev":false},{"cve":"CVE-2018-7600","published":"2018-03-29","fixed":"8.5.1","kev":true},{"cve":"CVE-2018-9861","published":"2018-04-19","fixed":"8.5.2","kev":false,"link":{"from":"CVE-2018-7600","to":"CVE-2018-9861","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/drupal","fromFixed":"8.4.6","toFixed":"8.4.7","daysApart":21},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"8.5.1","toFixed":"8.5.2","daysApart":21}]}},{"cve":"CVE-2018-7602","published":"2018-07-19","fixed":"8.5.3","kev":true,"link":{"from":"CVE-2018-7600","to":"CVE-2018-7602","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:drupal/drupal","fromFixed":"7.58","toFixed":"7.59","daysApart":112},{"kind":"version-step","provenance":"source","package":"Packagist:drupal/core","fromFixed":"7.58","toFixed":"7.59","daysApart":112}]}},{"cve":"CVE-2019-6338","published":"2019-01-22","fixed":"8.6.6","kev":false}],"package":"Packagist:drupal/drupal"}}