CVE-2024-55638: Drupal Core, друго

Описание

Оригинално описание

Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.

Засегнати продукти

• Drupal Drupal Core: 7.0 преди 7.102; 8.0.0 преди 10.2.11; 10.3.0 преди 10.3.9

Вид слабост

• CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

История

Други уязвимости в Drupal Drupal Core

• CVE-2026-108097
• CVE-2026-108515
• CVE-2026-108514
• 4.2CVE-2026-15916
• 4.7CVE-2026-15917

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2024-55638
• https://nvd.nist.gov/vuln/detail/CVE-2024-55638
• https://www.drupal.org/sa-core-2024-008