CVE-2024-55637: Drupal core contains a potential PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
Other sources
Drupal core contains a potential PHP Object Injection vulnerability
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 11.0.8 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 10.3.9 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 10.2.11 - Upgrade
Upgrade
composer/drupal/core-recommendedto a version that resolves this vulnerability.Fixed in 11.0.8 - Upgrade
Upgrade
composer/drupal/core-recommendedto a version that resolves this vulnerability.Fixed in 10.3.9 - Upgrade
Upgrade
composer/drupal/core-recommendedto a version that resolves this vulnerability.Fixed in 10.2.11 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 11.0.8 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 10.3.9 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 10.2.11 - Upgrade
Upgrade
Drupal Coreto a version that resolves this vulnerability.Fixed in 10.2.11 - Upgrade
Upgrade
Drupal Coreto a version that resolves this vulnerability.Fixed in 10.3.9 - Upgrade
Upgrade
Drupal Coreto a version that resolves this vulnerability.Fixed in 11.0.8
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55637?
CVE-2024-55637 is considered a critical vulnerability due to its potential for remote code execution through object injection.
How do I fix CVE-2024-55637?
To fix CVE-2024-55637, you need to upgrade your Drupal Core to at least version 11.0.8, 10.3.9, or 10.2.11.
What versions of Drupal are affected by CVE-2024-55637?
CVE-2024-55637 affects Drupal Core versions from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8.
Can CVE-2024-55637 lead to data breaches?
Yes, CVE-2024-55637 can lead to data breaches as it allows attackers to execute arbitrary code through deserialization of untrusted data.
What should I do if I cannot immediately update for CVE-2024-55637?
If you cannot immediately update, ensure your site is behind a firewall and limit access to sensitive areas while monitoring for any suspicious activity.