Drupal core contains a potential PHP Object Injection vulnerability
Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Remote Code Execution. It is not directly exploitable.
This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.
To help protect against this potential vulnerability, some additional checks have been added to Drupal core's database code. If you use a third-party database driver, check the release notes for additional configuration steps that may be required in certain cases.
This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | drupal/core | >= 8.8.0, < 10.2.11, >= 10.3.0, < 10.3.9, >= 7.0, < 7.102 | 10.2.11, 10.3.9, 7.102 |
| Paquete de Composer | drupal/core-recommended | >= 8.8.0, < 10.2.11, >= 10.3.0, < 10.3.9, >= 7.0, < 7.102 | 10.2.11, 10.3.9, 7.102 |
| Paquete de Composer | drupal/drupal | >= 8.8.0, < 10.2.11, >= 10.3.0, < 10.3.9, >= 7.0, < 7.102 | 10.2.11, 10.3.9, 7.102 |
| Drupal (núcleo) | drupal/core | >= 8.8.0, < 10.2.11, >= 10.3.0, < 10.3.9, >= 7.0, < 7.102, >= 8.8.0, < 10.2.11, >= 10.3.0, < 10.3.9, >= 7.0, < 7.102, >= 8.8.0, < 10.2.11, >= 10.3.0, < 10.3.9, >= 7.0, < 7.102 | 10.2.11, 10.3.9, 7.102 |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Debilidad (CWE)
CWE-502, CWE-915- Plataforma
- Composer, Drupal
- Paquete
drupal/core, drupal/core-recommended, drupal/drupal- Publicada
- 20.11.2024
- Actualizado
- 11.10.2026 12:17
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-gvf2-2f4g-jqf4 - CC BY 4.0
OSV / GitHub Advisory Database - DRUPAL-CORE-2024-008 - CC BY-SA 2.0; code GPL-2.0-or-later
Historial de vulnerabilidades: drupal/core-recommended
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 6
- Primera → última
- 08.2024 11.2024
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 2
- Media 3
- Baja 1
Divulgaciones por año
- 2024: 6
- 2025: 0
- 2026: 0
-
Drupal core contains a potential PHP Object Injection vulnerability esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.