Skip to content
OpenAdvisories
High NCSC-2024-0474 6 CVEs

Kwetsbaarheden verholpen in Drupal Core

Published Dec 10, 2024 · Updated Dec 10, 2024 · nl

Vendor: Drupal Vendor: OpenSource Product: Drupal Product: drupal

Summary

Drupal heeft kwetsbaarheden verholpen in Drupal Core (Specifiek voor versies 7.0 tot 7.102, 8.0.0 tot voor 10.2.11, 10.3.0 tot voor 10.3.9, en 11.0.0 tot voor 11.0.8).

Details

Interpretaties
De kwetsbaarheden in Drupal Core zijn gerelateerd aan privilege-escalatie en de deserialisatie van niet-vertrouwde gegevens, wat kan leiden tot objectinjectie. Deze kwetsbaarheden kunnen worden misbruikt door ongeautoriseerde gebruikers om verhoogde privileges te verkrijgen of om de applicatiegedraging te manipuleren, wat kan resulteren in ongeautoriseerde toegang tot gevoelige gegevens.

Oplossingen
Drupal heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 6

  • Critical 9.8
    CVE-2024-55636

    Drupal core - Less critical - Gadget chain - SA-CORE-2024-006

    Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • Critical 9.8
    CVE-2024-55637

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007

    Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • Critical 9.8
    CVE-2024-55638

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008

    Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core contains a chain of methods that is exploitable whe…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • High 8.1
    CVE-2024-55634

    Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004

    A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • Medium 6.1
    CVE-2024-55635

    Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 7.0 before 7.102.

    Drupal Drupal core drupal7 Web / CMS Ubuntu
  • Medium 5.4
    CVE-2024-12393

    Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist

Revision history

  1. #0

    Initiele versie

References