by Kastro CVE-2024-55636
Drupal Drupal Core — Drupal core - Less critical - Gadget chain - SA-CORE-2024-006
Description · from the CVE record
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so called gadget chain presents no direct threat, but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
Affected
ProductAffectedFixed inSource
Drupal Core8.0.0 – < 10.2.1110.2.11CNA
Drupal Core10.3.0 – < 10.3.910.3.9CNA
Drupal Core11.0.0 – < 11.0.811.0.8CNA
Scores by source
CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total