CVE-2024-55638: Drupal core contains a potential PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9.
Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
Other sources
Drupal core contains a potential PHP Object Injection vulnerability
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 7.102 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 10.3.9 - Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 10.2.11 - Upgrade
Upgrade
composer/drupal/core-recommendedto a version that resolves this vulnerability.Fixed in 7.102 - Upgrade
Upgrade
composer/drupal/core-recommendedto a version that resolves this vulnerability.Fixed in 10.3.9 - Upgrade
Upgrade
composer/drupal/core-recommendedto a version that resolves this vulnerability.Fixed in 10.2.11 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 7.102 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 10.3.9 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 10.2.11 - Upgrade
Upgrade
Drupal Coreto a version that resolves this vulnerability.Fixed in 7.102 - Upgrade
Upgrade
Drupal Coreto a version that resolves this vulnerability.Fixed in 10.2.11 - Upgrade
Upgrade
Drupal Coreto a version that resolves this vulnerability.Fixed in 10.3.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55638?
CVE-2024-55638 has been classified as a critical vulnerability due to its potential for object injection and remote code execution.
How do I fix CVE-2024-55638?
To fix CVE-2024-55638, update your Drupal installation to version 7.102, 10.2.11, or 10.3.9, depending on the version you are currently using.
Which Drupal versions are affected by CVE-2024-55638?
CVE-2024-55638 affects Drupal Core versions from 7.0 before 7.102, from 8.0.0 before 10.2.11, and from 10.3.0 before 10.3.9.
What types of attacks can exploit CVE-2024-55638?
CVE-2024-55638 can be exploited through deserialization of untrusted data, leading to object injection vulnerabilities.
Is there a workaround for CVE-2024-55638?
There are no specific workarounds for CVE-2024-55638; the recommended action is to update to the patched versions.