CVE-2024-55634

highpriority · track · 0EPSS 0.004 · 35 %ileDEEUNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.41% (35th) EPSS

CVSS 8.1 · high

Is it mine?

28 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-26

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

cvss

Technical severity, 0–10. One row per scoring source.

8.1

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.1highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondaryexploitability 2.8 · impact 5.2

v3.17.4highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-178USprimaryCWE-178USCWE-178USCWE-287USCWE-289USCWE-289US

affected products (28)

Products and version ranges known to be affected.

Open Source Drupal Drupal core <10.2.11all versionscert_bundDE
Open Source Drupal Drupal core <10.3.9all versionscert_bundDE
Open Source Drupal Drupal core <11.0.8all versionscert_bundDE
Open Source Drupal Drupal core <7.102all versionscert_bundDE
Open Source Drupal≤ Drupal core <7.102cert_bundDE
Open Source Drupal≤ Drupal core <10.2.11cert_bundDE
Open Source Drupal≤ Drupal core <10.3.9cert_bundDE
Open Source Drupal≤ Drupal core <11.0.8cert_bundDE
Drupal drupal core10.3.0 → 10.3.9enisa_euvdEU
Drupal drupal core11.0.0 → 11.0.8enisa_euvdEU
Drupal drupal core8.0.0 → 10.2.11enisa_euvdEU
Сообщество свободного программного обеспечения Drupal10.3.0 → 10.3.9fstec_bduRU
Сообщество свободного программного обеспечения Drupal11.0.0 → 11.0.8fstec_bduRU
Сообщество свободного программного обеспечения Drupal8.8.0 → 10.2.11fstec_bduRU
drupal drupal10.3.0 → 10.3.9nvdUScpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
drupal drupal11.0.0 → 11.0.8nvdUScpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
drupal drupal8.0.0 → 10.2.11nvdUScpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
Bitnami drupal11.0.0 → 11.0.8osvUSpkg:bitnami/drupal
Bitnami drupal8.0.0 → 10.3.9osvUSpkg:bitnami/drupal
Packagist drupal/core10.3.0 → 10.3.9osvUSpkg:composer/drupal/core

showing 20 of 28

advisories (5)

Vendor and ecosystem advisories describing this.

NCSC-2024-0474Kwetsbaarheden verholpen in Drupal CoreNL2024-12-10csaf · ncsc_nlNL
Drupal heeft kwetsbaarheden verholpen in Drupal Core (Specifiek voor versies 7.0 tot 7.102, 8.0.0 tot voor 10.2.11, 10.3.0 tot voor 10.3.9, en 11.0.0 tot voor 11.0.8).
WID-SEC-W-2024-3520Drupal: Mehrere SchwachstellenDeutsch2024-11-20csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen und einen Cross-Site-Scripting-Angriff durchzuführen.
GHSA-7cwc-fjqm-8vh8Drupal core Access bypass2024-12-10ghsa · osvUS
Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues. This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
BIT-drupal-2024-55634Drupal core - Moderately critical - Access bypass - SA-CORE-2024-0042025-06-03vendor · osvUS
A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
DRUPAL-CORE-2024-0042024-11-20vendor · osvUS
Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues.

also known as (8)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd ncsc_nl NVD CVE.org MITRE

published 2024-12-10modified 2026-06-17

related (145)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2020-12812US	critical9.8OT critical	45.4% (99th)	KEV	2020-07-24
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted…
CVE-2021-24347US	high8.8	54.1% (99th)	Exploit	2021-06-14
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be execu…
CVE-2001-0766US	critical9.8	8.16% (95th)	Exploit	2001-10-18
Apache on MacOS X Client 10.0.3 with the HFS+ file system allows remote attackers to bypass access restrictions via a URL that contains some characters whose case is not matched by…
CVE-2003-0411US	high7.5	25.1% (98th)	Exploit	2003-06-30
Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase ".JSP" extension instead of the lowercase…
CVE-2025-27636US	—	97.1% (100th)	Exploit	2025-03-09
Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4,…

+140 more

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan