Drupal core contains a potential PHP Object Injection vulnerability

🗓️ 10 Dec 2024 00:31:27Reported by GitHub Advisory DatabaseType

Drupal core PHP Object Injection vulnerability may lead to Arbitrary File Deletion when paired with other exploits.

Reporter	Title	Published	Views	Family All 26
Circl	CVE-2024-55636	9 Dec 202423:28	–	circl
CNNVD	Drupal core 安全漏洞	10 Dec 202400:00	–	cnnvd
CVE	CVE-2024-55636	9 Dec 202423:24	–	cve
Cvelist	CVE-2024-55636 Drupal core - Less critical - Gadget chain - SA-CORE-2024-006	9 Dec 202423:24	–	cvelist
Drupal	Drupal core - Less critical - Gadget chain - SA-CORE-2024-006	20 Nov 202400:00	–	drupal
Tenable Nessus	Drupal 7.x < 7.102 / 10.2.x < 10.2.11 / 10.3.x < 10.3.9 / 11.x < 11.0.8 Multiple Vulnerabilities (drupal-2024-11-20)	20 Nov 202400:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2024-55636	5 Aug 202500:00	–	nessus
Tenable Nessus	Drupal 11.0.x < 11.0.8 Multiple Vulnerabilities	26 Nov 202400:00	–	nessus
Tenable Nessus	Drupal 10.3.x < 10.3.9 Multiple Vulnerabilities	26 Nov 202400:00	–	nessus
Tenable Nessus	Drupal 10.2.x < 10.2.11 Multiple Vulnerabilities	26 Nov 202400:00	–	nessus

Vulners

Node

drupal drupalRange11.0.0–11.0.8composer

drupal drupalRange10.3.0–10.3.9composer

drupal drupalRange8.8.0–10.2.11composer

drupal core-recommendedRange11.0.0–11.0.8composer

drupal core-recommendedRange10.3.0–10.3.9composer

drupal core-recommendedRange8.8.0–10.2.11composer

drupal coreRange11.0.0–11.0.8composer

drupal coreRange10.3.0–10.3.9composer

drupal coreRange8.8.0–10.2.11composer

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-55636
drupal	www.drupal.org/sa-core-2024-006
github	www.github.com/drupal/core/commit/17f362b988e6ad6bd5cc1e7e8a7a0804e1536fbc
github	www.github.com/advisories/GHSA-938f-5r4f-h65v

04 Jun 2025 00:50Current

7.3High risk

Vulners AI Score7.3

CVSS 3.19.8

EPSS0.11473

SSVC