CVE-2024-55634

CWE-178CWE-2897 documents5 sources
Severity
8.1HIGH
EPSS
0.8%
top 25.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Drupal Drupal CoreDrupal DrupalDrupal Core+1 more
Timeline
PublishedDec 10

Description

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages5 packages

▶Packagistdrupal/core8.0.0 — 10.2.11+2
▶CVEListV5drupal/drupal_core8.0.0 — 10.2.11+2
▶Packagistdrupal/core-recommended8.0.0 — 10.2.11+2
▶NVDdrupal/drupal8.0.0 — 10.2.11+2
▶Packagistdrupal/drupal8.0.0 — 10.2.11+2

🔴Vulnerability Details

5
OSV
Drupal core Access bypass↗2024-12-10
▶
GHSA
Drupal core Access bypass↗2024-12-10
▶
OSV
CVE-2024-55634: A vulnerability in Drupal Core allows Privilege Escalation↗2024-12-10
▶
CVEList
Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004↗2024-12-09
▶
OSV
CVE-2024-55634: Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation↗2024-11-20
▶

📋Vendor Advisories

1
Drupal
Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004↗2024-11-20
▶
CVE-2024-55634 (HIGH CVSS 8.1) | A vulnerability in Drupal Core allo | cvebase.io