CVE-2024-55636: Drupal core contains a potential PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so called gadget chain presents no direct threat, but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
Other sources
Drupal core contains a potential PHP Object Injection vulnerability
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 11.0.8 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 10.3.9 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 10.2.11 - Upgrade
Upgrade
composer/drupal/core-recommendedto a version that resolves this vulnerability.Fixed in 11.0.8 - Upgrade
Upgrade
composer/drupal/core-recommendedto a version that resolves this vulnerability.Fixed in 10.3.9 - Upgrade
Upgrade
composer/drupal/core-recommendedto a version that resolves this vulnerability.Fixed in 10.2.11 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 11.0.8 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 10.3.9 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 10.2.11 - Upgrade
Upgrade
Drupal Coreto a version that resolves this vulnerability.Patch SA-CORE-2024-006
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55636?
CVE-2024-55636 is a critical severity vulnerability that allows for object injection through deserialization of untrusted data in Drupal Core.
How do I fix CVE-2024-55636?
To fix CVE-2024-55636, you should update Drupal Core to versions 11.0.8, 10.3.9, or 10.2.11, depending on your currently installed version.
Which versions of Drupal are affected by CVE-2024-55636?
CVE-2024-55636 affects Drupal Core versions prior to 10.2.11, 10.3.9, and 11.0.8.
Is CVE-2024-55636 easy to exploit?
Yes, the vulnerability can be easily exploited by attackers due to unsafe deserialization handling.
What can happen if I don't remediate CVE-2024-55636?
If CVE-2024-55636 is not remediated, it can allow attackers to execute arbitrary code or modify site data through object injection.