Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
https://www.drupal.org/sa-core-2024-007 |
History
Mon, 16 Dec 2024 17:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. |
Tue, 10 Dec 2024 22:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
cvssV3_1
|
Mon, 09 Dec 2024 23:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. | |
Title | Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007 | |
Weaknesses | CWE-915 | |
References |
|
MITRE
Status: PUBLISHED
Assigner: drupal
Published: 2024-12-09T23:25:32.356Z
Updated: 2024-12-16T17:10:40.749Z
Reserved: 2024-12-09T23:07:41.397Z
Link: CVE-2024-55637
Vulnrichment
Updated: 2024-12-10T21:20:45.554Z
NVD
Status : Awaiting Analysis
Published: 2024-12-10T00:15:22.650
Modified: 2024-12-16T18:15:11.673
Link: CVE-2024-55637
Redhat
No data.