CVE-2024-11942 - Vulnerability Details - OpenCVE

ReportizFlow

A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Drupal	Drupal Core

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-core-2024-002

History

Thu, 05 Dec 2024 16:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal drupal Core
CPEs		cpe:2.3:a:drupal:drupal_core::::::::
Vendors & Products		Drupal Drupal drupal Core
Metrics		cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 05 Dec 2024 14:45:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.
Title		Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002
Weaknesses		CWE-390
References		https://www.drupal.org/sa-core-2024-002

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2024-12-05T14:42:07.812Z

Updated: 2024-12-05T15:41:56.600Z

Reserved: 2024-11-27T23:16:49.385Z

Link: CVE-2024-11942

Vulnrichment

Updated: 2024-12-05T15:39:08.167Z

NVD

Status : Awaiting Analysis

Published: 2024-12-05T15:15:08.457

Modified: 2024-12-05T16:15:24.033

Link: CVE-2024-11942

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-11942", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2024-11-27T23:16:49.385Z", "datePublished": "2024-12-05T14:42:07.812Z", "dateUpdated": "2024-12-05T15:41:56.600Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/drupal", "defaultStatus": "unaffected", "product": "Drupal Core", "vendor": "Drupal", "versions": [{"lessThan": "10.2.10", "status": "affected", "version": "10.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff"}, {"lang": "en", "type": "remediation developer", "value": "catch"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands"}, {"lang": "en", "type": "remediation developer", "value": "Benji Fisher"}, {"lang": "en", "type": "remediation developer", "value": "Kim Pepper"}, {"lang": "en", "type": "remediation developer", "value": "Wim Leers"}, {"lang": "en", "type": "remediation developer", "value": "xjm"}, {"lang": "en", "type": "coordinator", "value": "Dave Long"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}], "datePublic": "2024-10-17T00:09:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A vulnerability in Drupal Core allows File Manipulation.<p>This issue affects Drupal Core: from 10.0.0 before 10.2.10.</p>"}], "value": "A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10."}], "impacts": [{"capecId": "CAPEC-165", "descriptions": [{"lang": "en", "value": "CAPEC-165 File Manipulation"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-390", "description": "CWE-390 Detection of Error Condition Without Action", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2024-12-05T14:42:07.812Z"}, "references": [{"url": "https://www.drupal.org/sa-core-2024-002"}], "source": {"discovery": "UNKNOWN"}, "title": "Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "drupal", "product": "drupal_core", "cpes": ["cpe:2.3:a:drupal:drupal_core:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "10.0.0", "status": "affected", "lessThan": "10.2.10", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-12-05T15:32:51.782373Z", "id": "CVE-2024-11942", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-05T15:41:56.600Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-11942", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-12-05T15:32:51.782373Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:drupal:drupal_core:*:*:*:*:*:*:*:*"], "vendor": "drupal", "product": "drupal_core", "versions": [{"status": "affected", "version": "10.0.0", "lessThan": "10.2.10", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-05T15:39:08.167Z"}}], "cna": {"title": "Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff"}, {"lang": "en", "type": "remediation developer", "value": "catch"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands"}, {"lang": "en", "type": "remediation developer", "value": "Benji Fisher"}, {"lang": "en", "type": "remediation developer", "value": "Kim Pepper"}, {"lang": "en", "type": "remediation developer", "value": "Wim Leers"}, {"lang": "en", "type": "remediation developer", "value": "xjm"}, {"lang": "en", "type": "coordinator", "value": "Dave Long"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}], "impacts": [{"capecId": "CAPEC-165", "descriptions": [{"lang": "en", "value": "CAPEC-165 File Manipulation"}]}], "affected": [{"vendor": "Drupal", "product": "Drupal Core", "versions": [{"status": "affected", "version": "10.0.0", "lessThan": "10.2.10", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/drupal", "defaultStatus": "unaffected"}], "datePublic": "2024-10-17T00:09:00.000Z", "references": [{"url": "https://www.drupal.org/sa-core-2024-002"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.", "supportingMedia": [{"type": "text/html", "value": "A vulnerability in Drupal Core allows File Manipulation.<p>This issue affects Drupal Core: from 10.0.0 before 10.2.10.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-390", "description": "CWE-390 Detection of Error Condition Without Action"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2024-12-05T14:42:07.812Z"}}}, "cveMetadata": {"cveId": "CVE-2024-11942", "state": "PUBLISHED", "dateUpdated": "2024-12-05T15:41:56.600Z", "dateReserved": "2024-11-27T23:16:49.385Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2024-12-05T14:42:07.812Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}