SA-CORE-2024-001: Critical severity Drupal Drupal vulnerability
Published Jan 17, 2024
·Updated
The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS). Sites that do not use the Comment module are not affected.
Credit
Alexander Antonenko, Doug Green
Affected Software
1 affected componentFixes available
Drupal Drupal<10.2.2, <10.1.8
10.2.210.1.8
Event History
Jan 17, 2024
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of SA-CORE-2024-001?
The severity of SA-CORE-2024-001 is critical due to its potential for causing a denial of service (DOS).
2
How do I fix SA-CORE-2024-001?
To fix SA-CORE-2024-001, you should upgrade your Drupal installation to versions 10.2.3 or 10.1.9 or later.
3
Who is affected by SA-CORE-2024-001?
Websites utilizing the Comment module in Drupal versions up to 10.2.2 and 10.1.8 are affected by SA-CORE-2024-001.
4
What types of attacks are associated with SA-CORE-2024-001?
SA-CORE-2024-001 is associated with denial of service (DOS) attacks caused by malicious comment reply requests.
5
Can I be vulnerable to SA-CORE-2024-001 if I don't use the Comment module?
No, sites that do not utilize the Comment module are not affected by SA-CORE-2024-001.