CVE-2024-11941 - Vulnerability Details - OpenCVE

ReportizFlow

A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Drupal	Drupal Core

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-core-2024-001

History

Thu, 05 Dec 2024 16:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal drupal Core
CPEs		cpe:2.3:a:drupal:drupal_core::::::::
Vendors & Products		Drupal Drupal drupal Core
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 05 Dec 2024 14:45:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.
Title		Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001
Weaknesses		CWE-835
References		https://www.drupal.org/sa-core-2024-001

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2024-12-05T14:39:37.975Z

Updated: 2024-12-05T15:45:37.085Z

Reserved: 2024-11-27T23:11:59.375Z

Link: CVE-2024-11941

Vulnrichment

Updated: 2024-12-05T15:45:23.491Z

NVD

Status : Awaiting Analysis

Published: 2024-12-05T15:15:08.340

Modified: 2024-12-05T16:15:23.893

Link: CVE-2024-11941

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-11941", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2024-11-27T23:11:59.375Z", "datePublished": "2024-12-05T14:39:37.975Z", "dateUpdated": "2024-12-05T15:45:37.085Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/drupal", "defaultStatus": "unaffected", "product": "Drupal Core", "repo": "https://git.drupalcode.org/project/drupal", "vendor": "Drupal", "versions": [{"lessThan": "10.2.2", "status": "affected", "version": "10.2.0", "versionType": "semver"}, {"lessThan": "10.1.8", "status": "affected", "version": "10.1.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Alexander Antonenko"}, {"lang": "en", "type": "finder", "value": "Doug Green"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands"}, {"lang": "en", "type": "remediation developer", "value": "Benji Fisher"}, {"lang": "en", "type": "remediation developer", "value": "Juraj Nemec"}, {"lang": "en", "type": "remediation developer", "value": "xjm"}, {"lang": "en", "type": "remediation developer", "value": "Lauri Eskola"}], "datePublic": "2024-01-18T00:55:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A vulnerability in Drupal Core allows Excessive Allocation.<p>This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.</p>"}], "value": "A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-835", "description": "CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2024-12-05T14:42:54.935Z"}, "references": [{"url": "https://www.drupal.org/sa-core-2024-001"}], "source": {"discovery": "UNKNOWN"}, "title": "Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "drupal", "product": "drupal_core", "cpes": ["cpe:2.3:a:drupal:drupal_core:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "10.1.0", "status": "affected", "lessThan": "10.1.8", "versionType": "semver"}, {"version": "10.2.0", "status": "affected", "lessThan": "10.2.2", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-12-05T15:42:55.345848Z", "id": "CVE-2024-11941", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-05T15:45:37.085Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-11941", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-05T15:42:55.345848Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:drupal:drupal_core:*:*:*:*:*:*:*:*"], "vendor": "drupal", "product": "drupal_core", "versions": [{"status": "affected", "version": "10.1.0", "lessThan": "10.1.8", "versionType": "semver"}, {"status": "affected", "version": "10.2.0", "lessThan": "10.2.2", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-05T15:45:23.491Z"}}], "cna": {"title": "Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Alexander Antonenko"}, {"lang": "en", "type": "finder", "value": "Doug Green"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands"}, {"lang": "en", "type": "remediation developer", "value": "Benji Fisher"}, {"lang": "en", "type": "remediation developer", "value": "Juraj Nemec"}, {"lang": "en", "type": "remediation developer", "value": "xjm"}, {"lang": "en", "type": "remediation developer", "value": "Lauri Eskola"}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/drupal", "vendor": "Drupal", "product": "Drupal Core", "versions": [{"status": "affected", "version": "10.2.0", "lessThan": "10.2.2", "versionType": "semver"}, {"status": "affected", "version": "10.1.0", "lessThan": "10.1.8", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/drupal", "defaultStatus": "unaffected"}], "datePublic": "2024-01-18T00:55:00.000Z", "references": [{"url": "https://www.drupal.org/sa-core-2024-001"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.", "supportingMedia": [{"type": "text/html", "value": "A vulnerability in Drupal Core allows Excessive Allocation.<p>This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2024-12-05T14:42:54.935Z"}}}, "cveMetadata": {"cveId": "CVE-2024-11941", "state": "PUBLISHED", "dateUpdated": "2024-12-05T15:45:37.085Z", "dateReserved": "2024-11-27T23:11:59.375Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2024-12-05T14:39:37.975Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}