CVE-2024-55634: Drupal Core Access Bypass Vulnerability
Summary
CVE-2024-55634: Drupal core Access bypass. Affects drupal/core across 3 version ranges.
>= 8.0.0, < 10.2.11
>= 10.3.0, < 10.3.9
>= 11.0.0, < 11.0.8
Fixed in 10.2.11, 10.3.9 or 11.0.8, depending on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2024-55634 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely-used open-source content management system (CMS) that enables users to create and manage websites easily. It is known for its flexibility, scalability, and extensive community support. However, like any software, it is susceptible to vulnerabilities. The specific vulnerability in question affects the uniqueness checking for user fields, particularly email addresses, leading to potential data integrity issues.
Vulnerability Detail
The vulnerability arises from inconsistent uniqueness checking for certain user fields in Drupal, which varies depending on the database engine and its collation settings. This inconsistency allows a user to register with the same email address as another existing user, potentially leading to unauthorized access to user accounts and data integrity issues. This flaw affects multiple versions of Drupal Core, specifically from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 10.2.1110.2.11composer require drupal/core:10.2.11 -
>= 10.3.0, < 10.3.910.3.9composer require drupal/core:10.3.9 -
>= 11.0.0, < 11.0.811.0.8composer require drupal/core:11.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing custom validation logic to check for unique email addresses before allowing user registration. This can be done by overriding the user registration form validation in your custom module.
Conclusion
In summary, CVE-2024-55634 is a significant vulnerability in Drupal Core that can lead to serious data integrity issues. It is crucial for users to update their installations to the patched versions to mitigate the risks associated with this vulnerability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for drupal/core →
FAQ
CVE-2024-55634 is a vulnerability in Drupal Core that allows users to register with the same email address as existing users, leading to potential data integrity issues.
The vulnerability affects Drupal Core versions from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, implement custom validation logic to ensure unique email addresses during user registration as a temporary workaround.
The vulnerability can lead to unauthorized access to user accounts and data integrity issues, compromising the security of the application.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
