CVE-2024-55634 - Vulnerability Details - OpenCVE

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-core-2024-004

History

Wed, 11 Dec 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 09 Dec 2024 23:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Title		Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004
Weaknesses		CWE-178 CWE-289
References		https://www.drupal.org/sa-core-2024-004

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2024-12-09T23:21:15.943Z

Updated: 2024-12-11T16:39:12.440Z

Reserved: 2024-12-09T23:07:41.397Z

Link: CVE-2024-55634

Vulnrichment

Updated: 2024-12-11T16:39:07.279Z

NVD

Status : Received

Published: 2024-12-10T00:15:22.323

Modified: 2024-12-11T17:15:21.243

Link: CVE-2024-55634

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-55634", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2024-12-09T23:07:41.397Z", "datePublished": "2024-12-09T23:21:15.943Z", "dateUpdated": "2024-12-11T16:39:12.440Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/drupal/", "defaultStatus": "unaffected", "product": "Drupal Core", "repo": "https://git.drupalcode.org/project/drupal", "vendor": "Drupal", "versions": [{"lessThan": "10.2.11", "status": "affected", "version": "8.0.0", "versionType": "semver"}, {"lessThan": "10.3.9", "status": "affected", "version": "10.3.0", "versionType": "semver"}, {"lessThan": "11.0.8", "status": "affected", "version": "11.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Wayne Eaker"}, {"lang": "en", "type": "remediation developer", "value": "Wayne Eaker"}, {"lang": "en", "type": "remediation developer", "value": "cilefen"}, {"lang": "en", "type": "remediation developer", "value": "Kristiaan Van den Eynde"}, {"lang": "en", "type": "remediation developer", "value": "Drew Webber"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands"}, {"lang": "en", "type": "coordinator", "value": "Benji Fisher"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}, {"lang": "en", "type": "coordinator", "value": "xjm"}], "datePublic": "2024-11-21T03:23:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A vulnerability in Drupal Core allows Privilege Escalation.<p>This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.</p>"}], "value": "A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-178", "description": "CWE-178 Improper Handling of Case Sensitivity", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-289", "description": "CWE-289", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2024-12-09T23:21:15.943Z"}, "references": [{"url": "https://www.drupal.org/sa-core-2024-004"}], "source": {"discovery": "UNKNOWN"}, "title": "Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-12-11T16:38:29.920886Z", "id": "CVE-2024-55634", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-11T16:39:12.440Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-55634", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-11T16:38:29.920886Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-11T16:39:07.279Z"}}], "cna": {"title": "Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Wayne Eaker"}, {"lang": "en", "type": "remediation developer", "value": "Wayne Eaker"}, {"lang": "en", "type": "remediation developer", "value": "cilefen"}, {"lang": "en", "type": "remediation developer", "value": "Kristiaan Van den Eynde"}, {"lang": "en", "type": "remediation developer", "value": "Drew Webber"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands"}, {"lang": "en", "type": "coordinator", "value": "Benji Fisher"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}, {"lang": "en", "type": "coordinator", "value": "xjm"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/drupal", "vendor": "Drupal", "product": "Drupal Core", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "10.2.11", "versionType": "semver"}, {"status": "affected", "version": "10.3.0", "lessThan": "10.3.9", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThan": "11.0.8", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/drupal/", "defaultStatus": "unaffected"}], "datePublic": "2024-11-21T03:23:00.000Z", "references": [{"url": "https://www.drupal.org/sa-core-2024-004"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.", "supportingMedia": [{"type": "text/html", "value": "A vulnerability in Drupal Core allows Privilege Escalation.<p>This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-178", "description": "CWE-178 Improper Handling of Case Sensitivity"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-289", "description": "CWE-289"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2024-12-09T23:21:15.943Z"}}}, "cveMetadata": {"cveId": "CVE-2024-55634", "state": "PUBLISHED", "dateUpdated": "2024-12-11T16:39:12.440Z", "dateReserved": "2024-12-09T23:07:41.397Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2024-12-09T23:21:15.943Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}