CVE-2024-55638
Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Attend
*SSVC
Descriptions
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9.
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9.
Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
*Credits:
Drew Webber, Drew Webber, Fabian Franz, Juraj Nemec, Lee Rowlands, Dave Long, Alex Pott, Juraj Nemec, Benji Fisher, xjm
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Attend
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-12-09 CVE Reserved
- 2024-12-09 CVE Published
- 2024-12-10 EPSS Updated
- 2024-12-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
CAPEC
- CAPEC-586: Object Injection
References (1)
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Drupal Search vendor "Drupal" | Drupal Core Search vendor "Drupal" for product "Drupal Core" | >= 7.0 < 7.102 Search vendor "Drupal" for product "Drupal Core" and version " >= 7.0 < 7.102" | en |
Affected
| ||||||
| Drupal Search vendor "Drupal" | Drupal Core Search vendor "Drupal" for product "Drupal Core" | >= 8.0.0 < 10.2.11 Search vendor "Drupal" for product "Drupal Core" and version " >= 8.0.0 < 10.2.11" | en |
Affected
| ||||||
| Drupal Search vendor "Drupal" | Drupal Core Search vendor "Drupal" for product "Drupal Core" | >= 10.3.0 < 10.3.9 Search vendor "Drupal" for product "Drupal Core" and version " >= 10.3.0 < 10.3.9" | en |
Affected
| ||||||