Description
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised.
Remediation
Upgrade to the most recent version of Drupal 7 or 8 core.
If you are running 7.x, upgrade to Drupal 7.59.
If you are running 8.5.x, upgrade to Drupal 8.5.3.
If you are running 8.4.x, upgrade to Drupal 8.4.8.
References
Related Vulnerabilities
WordPress 2.6.2 Remote Code Execution Vulnerability (0.70 - 2.6.2)
XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-30537)
WordPress Plugin WP eCommerce Multiple Vulnerabilities (3.8.9.5)
Drupal Core 8.5.x Remote Code Execution (8.5.0 - 8.5.2)
WordPress Plugin Groundhogg-Marketing Automation & CRM for WordPress Remote Code Execution (1.3.4)