Deserialization Of Untrusted Data

🗓️ 24 Dec 2024 04:53:52Reported by Veracode Vulnerability DatabaseType

Drupal Core is vulnerable to deserialization issues, allowing remote code execution via untrusted data.

Reporter	Title	Published	Views	Family All 31
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
BDU FSTEC	The vulnerability of the Drupal CMS system’s kernel lies in the insufficient control over the modification of dynamically defined object properties, allowing attackers to execute arbitrary code.	12 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-55638	9 Dec 202423:43	–	circl
CNNVD	Drupal core 安全漏洞	10 Dec 202400:00	–	cnnvd
CVE	CVE-2024-55638	9 Dec 202423:26	–	cve
Cvelist	CVE-2024-55638 Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008	9 Dec 202423:26	–	cvelist
Drupal	Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008	20 Nov 202400:00	–	drupal
Tenable Nessus	Drupal 7.x < 7.102 / 10.2.x < 10.2.11 / 10.3.x < 10.3.9 / 11.x < 11.0.8 Multiple Vulnerabilities (drupal-2024-11-20)	20 Nov 202400:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2024-55638	15 Aug 202500:00	–	nessus
Tenable Nessus	Drupal 11.0.x < 11.0.8 Multiple Vulnerabilities	26 Nov 202400:00	–	nessus

Vulners

Node

core drupal/coreRange8.8.0-alpha1–10.2.10php

core drupal/coreRange10.3.0-beta1–10.3.8php

core drupal/coreRange7.0–7.101php

drupal drupal/drupalRange8.8.0-alpha1–10.2.10php

drupal drupal/drupalRange10.3.0-beta1–10.3.8php

drupal drupal/drupalRange7.0–7.101php

Source	Link
github	www.github.com/drupal/core/commit/af736938936fd5d9650201f4e3bf4845c7c9069a
github	www.github.com/advisories/GHSA-gvf2-2f4g-jqf4
drupal	www.drupal.org/sa-core-2024-008

02 Jun 2025 19:51Current

8High risk

Vulners AI Score8

CVSS 3.19.8

EPSS0.09687

SSVC