cbcvebase.
CVE-2024-55638
published 2024-12-10

CVE-2024-55638: Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before…

PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.96%
57.0th percentile
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.

Affected

17 ranges
VendorProductVersion rangeFixed in
drupalcore>= 10.3.0 < 10.3.910.3.9
drupalcore>= 7.0 < 7.1027.102
drupalcore>= 8.0.0 < 10.2.1110.2.11
drupalcore>= 8.8.0 < 10.2.1110.2.11
drupalcore-recommended>= 10.3.0 < 10.3.910.3.9
drupalcore-recommended>= 7.0 < 7.1027.102
drupalcore-recommended>= 8.8.0 < 10.2.1110.2.11
drupaldrupal>= 10.3.0 < 10.3.910.3.9
drupaldrupal>= 10.3.0 < 10.3.910.3.9
drupaldrupal>= 7.0 < 7.1027.102
drupaldrupal>= 7.0 < 7.1027.102
drupaldrupal>= 8.0.0 < 10.2.1110.2.11
drupaldrupal>= 8.8.0 < 10.2.1110.2.11
drupaldrupal_core
drupaldrupal_core>= 10.3.0 < 10.3.910.3.9
drupaldrupal_core>= 7.0 < 7.1027.102
drupaldrupal_core>= 8.0.0 < 10.2.1110.2.11

Detection & IOCsextracted from sources · hover to see the quote

  • Additional checks were added to Drupal core's database code as a mitigation; if using a third-party database driver, check release notes for additional configuration steps that may be required — absence of these checks may indicate an unpatched or misconfigured instance.
  • Flag Drupal Core versions in the affected ranges (7.0–7.101, 8.0.0–10.2.10, 10.3.0–10.3.8) during asset inventory or vulnerability scanning, as these are unpatched against the gadget chain.
  • ·The gadget chain itself is not directly exploitable; exploitation requires a separate vulnerability that passes untrusted data to unserialize(). There are no known such exploits in Drupal core at time of disclosure.
  • ·Sites using third-party database drivers may require additional manual configuration steps beyond simply updating Drupal core — consult the driver's release notes.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.