CVE-2024-55634: Drupal Core Access Bypass Vulnerability
Summary
CVE-2024-55634: Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004. Affects drupal across 2 version ranges.
>= 8.0.0, < 10.3.9
>= 11.0.0, < 11.0.8
Fixed in 10.3.9 or 11.0.8, depending on the release line you run. How to fix ↓
Also tracked for
- drupal/core · Packagist
The same CVE-2024-55634 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely-used open-source content management system (CMS) that enables users to build and manage websites with ease. It is known for its flexibility, scalability, and robust community support. However, like any software, it is susceptible to vulnerabilities that can compromise its security. The vulnerability identified as CVE-2024-55634 affects specific versions of Drupal Core, allowing unauthorized users to escalate their privileges, which can lead to unauthorized access to sensitive information or functionalities.
Vulnerability Detail
The vulnerability in Drupal Core allows for privilege escalation, which means that users with lower access rights can gain higher privileges than intended. This issue affects versions of Drupal Core from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8. If exploited, this vulnerability could allow attackers to perform actions that should be restricted to higher-privileged users, potentially compromising the integrity and confidentiality of the site.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 10.3.910.3.9 -
>= 11.0.0, < 11.0.811.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to sensitive functionalities and monitor user permissions closely until the update is applied. Additionally, consider disabling any modules that may expose sensitive features until the vulnerability is resolved.
Conclusion
In summary, CVE-2024-55634 is a moderately critical vulnerability in Drupal Core that allows for privilege escalation. It is crucial for users to update their installations to the latest patched versions to mitigate the risk of unauthorized access. Regular monitoring and updates are essential for maintaining the security of your Drupal sites.
See every vulnerability recorded for drupal →
FAQ
CVE-2024-55634 is a vulnerability in Drupal Core that allows for privilege escalation, potentially enabling unauthorized users to gain higher access rights.
The affected versions include Drupal Core from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability could lead to unauthorized access to sensitive data and functionalities, potentially compromising the security of your website.
It is recommended to regularly check for updates and apply them promptly to ensure that your Drupal installation is secure against known vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal.
