CVE-2024-11942: Drupal Core Improper Error Handling Vulnerability
Summary
CVE-2024-11942: Drupal core vulnerable to improper error handling. Affects drupal/core versions >= 10.0.0, < 10.2.10. Fixed in 10.2.10. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2024-11942 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely-used open-source content management system (CMS) that enables users to create and manage websites easily. It is known for its flexibility, scalability, and extensive community support. The CKEditor 5 module is an integral part of Drupal that allows users to edit content with a rich text editor. However, under certain uncommon configurations, a vulnerability has been identified that can lead to improper error handling, affecting the stability of the site.
Vulnerability Detail
The vulnerability arises from a bug in the CKEditor 5 module, which can cause image uploads to inadvertently move the entire webroot to a different location on the file system. This situation can be exploited by a malicious user to potentially take down the site. The issue is particularly concerning as it requires several non-default site configurations to be present simultaneously, making it a moderate risk but still a significant concern for affected installations.
How To Fix
Minimum fixed version
10.2.10
This is the first release that contains the fix.
composer require drupal/core:10.2.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can review and adjust site configurations to avoid the specific conditions that lead to this vulnerability. Additionally, restricting user permissions for image uploads may help mitigate the risk until the package is updated.
Conclusion
In summary, CVE-2024-11942 is a moderate vulnerability affecting Drupal core due to improper error handling in the CKEditor 5 module. It is crucial for users to update to the latest version to mitigate risks and ensure the stability of their sites. Utilizing tools like Vulert can help maintain awareness of vulnerabilities in open-source software.
See every vulnerability recorded for drupal/core →
FAQ
CVE-2024-11942 is a vulnerability in Drupal core related to improper error handling in the CKEditor 5 module, which can lead to significant site stability issues.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability could allow a malicious user to disrupt the functionality of the site by moving the webroot, potentially leading to downtime or data loss.
Yes, a patch is available. Users should update their Drupal core to version 10.2.10 or later to ensure they are protected against this vulnerability.
The CVSS score for this vulnerability is 5.9, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
