CVE-2024-55634 - Vulnerability Details - OpenCVE

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00211.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Drupal	Drupal

Configuration 1 [-]

OR	cpe:2.3:a:drupal:drupal::::::::
	cpe:2.3:a:drupal:drupal::::::::
	cpe:2.3:a:drupal:drupal::::::::

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.drupal.org/sa-core-2024-004

History

Tue, 15 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00051}`	epss `{'score': 0.00057}`

Mon, 02 Jun 2025 16:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal drupal
CPEs		cpe:2.3:a:drupal:drupal::::::::
Vendors & Products		Drupal Drupal drupal

Wed, 11 Dec 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 09 Dec 2024 23:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Title		Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004
Weaknesses		CWE-178 CWE-289
References		https://www.drupal.org/sa-core-2024-004

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2024-12-09T23:21:15.943Z

Updated: 2024-12-11T16:39:12.440Z

Reserved: 2024-12-09T23:07:41.397Z

Link: CVE-2024-55634

Vulnrichment

Updated: 2024-12-11T16:39:07.279Z

NVD

Status : Analyzed

Published: 2024-12-10T00:15:22.323

Modified: 2025-06-02T16:21:42.227

Link: CVE-2024-55634

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-55634", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2024-12-09T23:07:41.397Z", "datePublished": "2024-12-09T23:21:15.943Z", "dateUpdated": "2024-12-11T16:39:12.440Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/drupal/", "defaultStatus": "unaffected", "product": "Drupal Core", "repo": "https://git.drupalcode.org/project/drupal", "vendor": "Drupal", "versions": [{"lessThan": "10.2.11", "status": "affected", "version": "8.0.0", "versionType": "semver"}, {"lessThan": "10.3.9", "status": "affected", "version": "10.3.0", "versionType": "semver"}, {"lessThan": "11.0.8", "status": "affected", "version": "11.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Wayne Eaker"}, {"lang": "en", "type": "remediation developer", "value": "Wayne Eaker"}, {"lang": "en", "type": "remediation developer", "value": "cilefen"}, {"lang": "en", "type": "remediation developer", "value": "Kristiaan Van den Eynde"}, {"lang": "en", "type": "remediation developer", "value": "Drew Webber"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands"}, {"lang": "en", "type": "coordinator", "value": "Benji Fisher"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}, {"lang": "en", "type": "coordinator", "value": "xjm"}], "datePublic": "2024-11-21T03:23:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A vulnerability in Drupal Core allows Privilege Escalation.<p>This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.</p>"}], "value": "A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-178", "description": "CWE-178 Improper Handling of Case Sensitivity", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-289", "description": "CWE-289", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2024-12-09T23:21:15.943Z"}, "references": [{"url": "https://www.drupal.org/sa-core-2024-004"}], "source": {"discovery": "UNKNOWN"}, "title": "Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-12-11T16:38:29.920886Z", "id": "CVE-2024-55634", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-11T16:39:12.440Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-55634", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-11T16:38:29.920886Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-11T16:39:07.279Z"}}], "cna": {"title": "Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Wayne Eaker"}, {"lang": "en", "type": "remediation developer", "value": "Wayne Eaker"}, {"lang": "en", "type": "remediation developer", "value": "cilefen"}, {"lang": "en", "type": "remediation developer", "value": "Kristiaan Van den Eynde"}, {"lang": "en", "type": "remediation developer", "value": "Drew Webber"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands"}, {"lang": "en", "type": "coordinator", "value": "Benji Fisher"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}, {"lang": "en", "type": "coordinator", "value": "xjm"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/drupal", "vendor": "Drupal", "product": "Drupal Core", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "10.2.11", "versionType": "semver"}, {"status": "affected", "version": "10.3.0", "lessThan": "10.3.9", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThan": "11.0.8", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/drupal/", "defaultStatus": "unaffected"}], "datePublic": "2024-11-21T03:23:00.000Z", "references": [{"url": "https://www.drupal.org/sa-core-2024-004"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.", "supportingMedia": [{"type": "text/html", "value": "A vulnerability in Drupal Core allows Privilege Escalation.<p>This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-178", "description": "CWE-178 Improper Handling of Case Sensitivity"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-289", "description": "CWE-289"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2024-12-09T23:21:15.943Z"}}}, "cveMetadata": {"cveId": "CVE-2024-55634", "state": "PUBLISHED", "dateUpdated": "2024-12-11T16:39:12.440Z", "dateReserved": "2024-12-09T23:07:41.397Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2024-12-09T23:21:15.943Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}