CVE-2024-11941: Drupal Core Denial of Service Vulnerability
Summary
CVE-2024-11941: Drupal core Denial of Service. Affects drupal/core across 2 version ranges.
>= 10.1.0, < 10.1.8
>= 10.2.0, < 10.2.2
Fixed in 10.1.8 or 10.2.2, depending on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2024-11941 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a popular open-source content management system (CMS) that enables users to build and manage websites easily. It offers a wide range of features, including user management, content creation, and extensibility through modules. The Comment module in Drupal allows users to engage with content by replying to comments. However, this module has been identified as vulnerable to a Denial of Service (DoS) attack, which can disrupt the normal functioning of the website.
Vulnerability Detail
The vulnerability arises from the Comment module's handling of comment reply requests. An attacker can exploit this by sending a series of crafted requests that overwhelm the server, leading to a denial of service. This can result in the website becoming unresponsive, affecting all users. The vulnerability is classified under CWE-835, indicating that it can lead to resource exhaustion. Sites that do not utilize the Comment module are not affected by this issue.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 10.1.0, < 10.1.810.1.8composer require drupal/core:10.1.8 -
>= 10.2.0, < 10.2.210.2.2composer require drupal/core:10.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not possible, consider disabling the Comment module temporarily to prevent exploitation of this vulnerability. You can do this by navigating to the admin interface and unchecking the Comment module under the Extend section.
Conclusion
In summary, CVE-2024-11941 is a significant vulnerability in the Drupal core's Comment module that can lead to Denial of Service attacks. It is crucial for users to update their installations to the patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for drupal/core →
FAQ
CVE-2024-11941 is a vulnerability in the Drupal core that allows for Denial of Service attacks through the Comment module.
If your site uses the Comment module and is running versions 10.1.0 to 10.1.7 or 10.2.0 to 10.2.1, it is vulnerable.
Exploitation of this vulnerability can lead to your website becoming unresponsive, affecting user access and functionality.
Yes, tools like Vulert can monitor your application for open-source vulnerabilities in real-time using your composer.lock file.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
