Drupal Core Vulnerability Allows Object Injection Through Deserialization of Untrusted Data
CVE-2024-55636

Currently unrated

Key Information:

Vendor

Drupal
Status
Drupal
Vendor
CVE Published:
10 December 2024

What is CVE-2024-55636?

Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so called gadget chain presents no direct threat, but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://www.drupal.org/sa-core-2024-006

EPSS Score

8% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

JSON
.