CVE-2024-55634

highPriorität · verfolgen · 0EPSS 0.004 · 35. PerzentilDEEUNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.41% (35th) EPSS

CVSS 8.1 · high

Is it mine?

28 products

Prüfe deine Angriffsfläche

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-26

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18.1highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NsecondaryAusnutzbarkeit 2.8 · Auswirkung 5.2

v3.17.4highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-178USprimärCWE-178USCWE-178USCWE-287USCWE-289USCWE-289US

betroffene Produkte (28)

Betroffene Produkte und Versionsbereiche.

Open Source Drupal Drupal core <10.2.11alle Versionencert_bundDE
Open Source Drupal Drupal core <10.3.9alle Versionencert_bundDE
Open Source Drupal Drupal core <11.0.8alle Versionencert_bundDE
Open Source Drupal Drupal core <7.102alle Versionencert_bundDE
Open Source Drupal≤ Drupal core <7.102cert_bundDE
Open Source Drupal≤ Drupal core <10.2.11cert_bundDE
Open Source Drupal≤ Drupal core <10.3.9cert_bundDE
Open Source Drupal≤ Drupal core <11.0.8cert_bundDE
Drupal drupal core10.3.0 → 10.3.9enisa_euvdEU
Drupal drupal core11.0.0 → 11.0.8enisa_euvdEU
Drupal drupal core8.0.0 → 10.2.11enisa_euvdEU
Сообщество свободного программного обеспечения Drupal10.3.0 → 10.3.9fstec_bduRU
Сообщество свободного программного обеспечения Drupal11.0.0 → 11.0.8fstec_bduRU
Сообщество свободного программного обеспечения Drupal8.8.0 → 10.2.11fstec_bduRU
drupal drupal10.3.0 → 10.3.9nvdUScpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
drupal drupal11.0.0 → 11.0.8nvdUScpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
drupal drupal8.0.0 → 10.2.11nvdUScpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
Bitnami drupal11.0.0 → 11.0.8osvUSpkg:bitnami/drupal
Bitnami drupal8.0.0 → 10.3.9osvUSpkg:bitnami/drupal
Packagist drupal/core10.3.0 → 10.3.9osvUSpkg:composer/drupal/core

20 von 28 angezeigt

Advisories (5)

Hersteller- und Ökosystem-Meldungen dazu.

NCSC-2024-0474Kwetsbaarheden verholpen in Drupal CoreNL2024-12-10csaf · ncsc_nlNL
Drupal heeft kwetsbaarheden verholpen in Drupal Core (Specifiek voor versies 7.0 tot 7.102, 8.0.0 tot voor 10.2.11, 10.3.0 tot voor 10.3.9, en 11.0.0 tot voor 11.0.8).
WID-SEC-W-2024-3520Drupal: Mehrere SchwachstellenDeutsch2024-11-20csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen und einen Cross-Site-Scripting-Angriff durchzuführen.
GHSA-7cwc-fjqm-8vh8Drupal core Access bypass2024-12-10ghsa · osvUS
Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues. This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
BIT-drupal-2024-55634Drupal core - Moderately critical - Access bypass - SA-CORE-2024-0042025-06-03vendor · osvUS
A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
DRUPAL-CORE-2024-0042024-11-20vendor · osvUS
Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues.

auch bekannt als (8)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd ncsc_nl NVD CVE.org MITRE

veröffentlicht 2024-12-10geändert 2026-06-17

verwandt (145)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2020-12812US	critical9.8OT kritisch	45.4% (99th)	KEV	2020-07-24
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted…
CVE-2021-24347US	high8.8	54.1% (99th)	Exploit	2021-06-14
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be execu…
CVE-2001-0766US	critical9.8	8.16% (95th)	Exploit	2001-10-18
Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by…
CVE-2003-0411US	high7.5	25.1% (98th)	Exploit	2003-06-30
Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" extension instead of the lowercase…
CVE-2025-27636US	—	97.1% (100th)	Exploit	2025-03-09
Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4,…

+140 weitere

Referenzen (4)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan