CVE-2024-55634 - Vulnerability Details

Vendors	Products
Drupal	Drupal

Link	Providers
https://www.drupal.org/sa-core-2024-004

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00051}`	epss `{'score': 0.00057}`

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal drupal
CPEs		cpe:2.3:a:drupal:drupal::::::::
Vendors & Products		Drupal Drupal drupal

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Title		Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004
Weaknesses		CWE-178 CWE-289
References		https://www.drupal.org/sa-core-2024-004

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-55634", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2024-12-09T23:07:41.397Z", "datePublished": "2024-12-09T23:21:15.943Z", "dateUpdated": "2024-12-11T16:39:12.440Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/drupal/", "defaultStatus": "unaffected", "product": "Drupal Core", "repo": "https://git.drupalcode.org/project/drupal", "vendor": "Drupal", "versions": [{"lessThan": "10.2.11", "status": "affected", "version": "8.0.0", "versionType": "semver"}, {"lessThan": "10.3.9", "status": "affected", "version": "10.3.0", "versionType": "semver"}, {"lessThan": "11.0.8", "status": "affected", "version": "11.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Wayne Eaker"}, {"lang": "en", "type": "remediation developer", "value": "Wayne Eaker"}, {"lang": "en", "type": "remediation developer", "value": "cilefen"}, {"lang": "en", "type": "remediation developer", "value": "Kristiaan Van den Eynde"}, {"lang": "en", "type": "remediation developer", "value": "Drew Webber"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands"}, {"lang": "en", "type": "coordinator", "value": "Benji Fisher"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}, {"lang": "en", "type": "coordinator", "value": "xjm"}], "datePublic": "2024-11-21T03:23:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A vulnerability in Drupal Core allows Privilege Escalation.<p>This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.</p>"}], "value": "A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-178", "description": "CWE-178 Improper Handling of Case Sensitivity", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-289", "description": "CWE-289", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2024-12-09T23:21:15.943Z"}, "references": [{"url": "https://www.drupal.org/sa-core-2024-004"}], "source": {"discovery": "UNKNOWN"}, "title": "Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-12-11T16:38:29.920886Z", "id": "CVE-2024-55634", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-11T16:39:12.440Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-55634 (string)

assignerOrgId : 2c85b837-eb8b-40ed-9d74-228c62987387 (string)

state : PUBLISHED (string)

assignerShortName : drupal (string)

dateReserved : 2024-12-09T23:07:41.397Z (string)

datePublished : 2024-12-09T23:21:15.943Z (string)

dateUpdated : 2024-12-11T16:39:12.440Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

collectionURL : https://www.drupal.org/project/drupal/ (string)

defaultStatus : unaffected (string)

product : Drupal Core (string)

repo : https://git.drupalcode.org/project/drupal (string)

vendor : Drupal (string)

versions : [ »

0 : { »

lessThan : 10.2.11 (string)

status : affected (string)

version : 8.0.0 (string)

versionType : semver (string)

}

1 : { »

lessThan : 10.3.9 (string)

status : affected (string)

version : 10.3.0 (string)

versionType : semver (string)

}

2 : { »

lessThan : 11.0.8 (string)

status : affected (string)

version : 11.0.0 (string)

versionType : semver (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Wayne Eaker (string)

}

1 : { »

lang : en (string)

type : remediation developer (string)

value : Wayne Eaker (string)

}

2 : { »

lang : en (string)

type : remediation developer (string)

value : cilefen (string)

}

3 : { »

lang : en (string)

type : remediation developer (string)

value : Kristiaan Van den Eynde (string)

}

4 : { »

lang : en (string)

type : remediation developer (string)

value : Drew Webber (string)

}

5 : { »

lang : en (string)

type : remediation developer (string)

value : Lee Rowlands (string)

}

6 : { »

lang : en (string)

type : coordinator (string)

value : Benji Fisher (string)

}

7 : { »

lang : en (string)

type : coordinator (string)

value : Juraj Nemec (string)

}

8 : { »

lang : en (string)

type : coordinator (string)

value : xjm (string)

}

]

datePublic : 2024-11-21T03:23:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : A vulnerability in Drupal Core allows Privilege Escalation.<p>This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.</p> (string)

}

]

value : A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-233 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-233 Privilege Escalation (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-178 (string)

description : CWE-178 Improper Handling of Case Sensitivity (string)

lang : en (string)

type : CWE (string)

}

]

}

1 : { »

descriptions : [ »

0 : { »

cweId : CWE-289 (string)

description : CWE-289 (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 2c85b837-eb8b-40ed-9d74-228c62987387 (string)

shortName : drupal (string)

dateUpdated : 2024-12-09T23:21:15.943Z (string)

}

references : [ »

0 : { »

url : https://www.drupal.org/sa-core-2024-004 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004 (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 8.1 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-12-11T16:38:29.920886Z (string)

id : CVE-2024-55634 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-12-11T16:39:12.440Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-55634", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-11T16:38:29.920886Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-11T16:39:07.279Z"}}], "cna": {"title": "Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Wayne Eaker"}, {"lang": "en", "type": "remediation developer", "value": "Wayne Eaker"}, {"lang": "en", "type": "remediation developer", "value": "cilefen"}, {"lang": "en", "type": "remediation developer", "value": "Kristiaan Van den Eynde"}, {"lang": "en", "type": "remediation developer", "value": "Drew Webber"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands"}, {"lang": "en", "type": "coordinator", "value": "Benji Fisher"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}, {"lang": "en", "type": "coordinator", "value": "xjm"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/drupal", "vendor": "Drupal", "product": "Drupal Core", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "10.2.11", "versionType": "semver"}, {"status": "affected", "version": "10.3.0", "lessThan": "10.3.9", "versionType": "semver"}, {"status": "affected", "version": "11.0.0", "lessThan": "11.0.8", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/drupal/", "defaultStatus": "unaffected"}], "datePublic": "2024-11-21T03:23:00.000Z", "references": [{"url": "https://www.drupal.org/sa-core-2024-004"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.", "supportingMedia": [{"type": "text/html", "value": "A vulnerability in Drupal Core allows Privilege Escalation.<p>This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-178", "description": "CWE-178 Improper Handling of Case Sensitivity"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-289", "description": "CWE-289"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2024-12-09T23:21:15.943Z"}}}, "cveMetadata": {"cveId": "CVE-2024-55634", "state": "PUBLISHED", "dateUpdated": "2024-12-11T16:39:12.440Z", "dateReserved": "2024-12-09T23:07:41.397Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2024-12-09T23:21:15.943Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 8.1 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-55634 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-12-11T16:38:29.920886Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-12-11T16:39:07.279Z (string)

}

]

cna : { »

title : Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004 (string)

source : { »

discovery : UNKNOWN (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Wayne Eaker (string)

}

1 : { »

lang : en (string)

type : remediation developer (string)

value : Wayne Eaker (string)

}

2 : { »

lang : en (string)

type : remediation developer (string)

value : cilefen (string)

}

3 : { »

lang : en (string)

type : remediation developer (string)

value : Kristiaan Van den Eynde (string)

}

4 : { »

lang : en (string)

type : remediation developer (string)

value : Drew Webber (string)

}

5 : { »

lang : en (string)

type : remediation developer (string)

value : Lee Rowlands (string)

}

6 : { »

lang : en (string)

type : coordinator (string)

value : Benji Fisher (string)

}

7 : { »

lang : en (string)

type : coordinator (string)

value : Juraj Nemec (string)

}

8 : { »

lang : en (string)

type : coordinator (string)

value : xjm (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-233 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-233 Privilege Escalation (string)

}

]

}

]

affected : [ »

0 : { »

repo : https://git.drupalcode.org/project/drupal (string)

vendor : Drupal (string)

product : Drupal Core (string)

versions : [ »

0 : { »

status : affected (string)

version : 8.0.0 (string)

lessThan : 10.2.11 (string)

versionType : semver (string)

}

1 : { »

status : affected (string)

version : 10.3.0 (string)

lessThan : 10.3.9 (string)

versionType : semver (string)

}

2 : { »

status : affected (string)

version : 11.0.0 (string)

lessThan : 11.0.8 (string)

versionType : semver (string)

}

]

collectionURL : https://www.drupal.org/project/drupal/ (string)

defaultStatus : unaffected (string)

}

]

datePublic : 2024-11-21T03:23:00.000Z (string)

references : [ »

0 : { »

url : https://www.drupal.org/sa-core-2024-004 (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : A vulnerability in Drupal Core allows Privilege Escalation.<p>This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.</p> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-178 (string)

description : CWE-178 Improper Handling of Case Sensitivity (string)

}

]

}

1 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-289 (string)

description : CWE-289 (string)

}

]

}

]

providerMetadata : { »

orgId : 2c85b837-eb8b-40ed-9d74-228c62987387 (string)

shortName : drupal (string)

dateUpdated : 2024-12-09T23:21:15.943Z (string)

}

cveMetadata : { »

cveId : CVE-2024-55634 (string)

state : PUBLISHED (string)

dateUpdated : 2024-12-11T16:39:12.440Z (string)

dateReserved : 2024-12-09T23:07:41.397Z (string)

assignerOrgId : 2c85b837-eb8b-40ed-9d74-228c62987387 (string)

datePublished : 2024-12-09T23:21:15.943Z (string)

assignerShortName : drupal (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "29A04440-F97A-4813-AD9E-88C0BD1C5989", "versionEndExcluding": "10.2.11", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "444B0D25-710A-400B-9161-75B4A00F7648", "versionEndExcluding": "10.3.9", "versionStartIncluding": "10.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "5DF1AC15-FA7D-467D-8AF0-8FB86D854CB6", "versionEndExcluding": "11.0.8", "versionStartIncluding": "11.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8."}, {"lang": "es", "value": "Una vulnerabilidad en Drupal Core permite la escalada de privilegios. Este problema afecta a Drupal Core: desde 8.0.0 hasta 10.2.11, desde 10.3.0 hasta 10.3.9, desde 11.0.0 hasta 11.0.8."}], "id": "CVE-2024-55634", "lastModified": "2025-06-02T16:21:42.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-12-10T00:15:22.323", "references": [{"source": "mlhess@drupal.org", "tags": ["Vendor Advisory"], "url": "https://www.drupal.org/sa-core-2024-004"}], "sourceIdentifier": "mlhess@drupal.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-178"}, {"lang": "en", "value": "CWE-289"}], "source": "mlhess@drupal.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-178"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 29A04440-F97A-4813-AD9E-88C0BD1C5989 (string)

versionEndExcluding : 10.2.11 (string)

versionStartIncluding : 8.0.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 444B0D25-710A-400B-9161-75B4A00F7648 (string)

versionEndExcluding : 10.3.9 (string)

versionStartIncluding : 10.3.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 5DF1AC15-FA7D-467D-8AF0-8FB86D854CB6 (string)

versionEndExcluding : 11.0.8 (string)

versionStartIncluding : 11.0.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. (string)

}

1 : { »

lang : es (string)

value : Una vulnerabilidad en Drupal Core permite la escalada de privilegios. Este problema afecta a Drupal Core: desde 8.0.0 hasta 10.2.11, desde 10.3.0 hasta 10.3.9, desde 11.0.0 hasta 11.0.8. (string)

}

]

id : CVE-2024-55634 (string)

lastModified : 2025-06-02T16:21:42.227 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 8.1 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.2 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2024-12-10T00:15:22.323 (string)

references : [ »

0 : { »

source : mlhess@drupal.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.drupal.org/sa-core-2024-004 (string)

}

]

sourceIdentifier : mlhess@drupal.org (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-178 (string)

}

1 : { »

lang : en (string)

value : CWE-289 (string)

}

]

source : mlhess@drupal.org (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-178 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object