Another Drupal Remote Code Execution vulnerability has been discovered and was made public on April 25th, 2018, making this the 3rd vulnerability and 2nd “Highly Critical Vulnerability” to be disclosed in the last 30 days for the Drupal Core. The vulnerability (CVE-2018-7602) allows an attacker to exploit multiple attack vectors of the subsystems of Drupal 7.x and 8.x, resulting in a complete compromise of the site. There are reports that this vulnerability is currently being exploited in the wild.
Drupal 7 and Drupal 8 sites are affected and vulnerable to exploitation.
TechCERT recommends all Drupal users update their sites to the most recent version of Drupal being used at your earliest.
Note: These patches will only work if your site already has the fix from SA-CORE-2018-002 applied.
