CVE-2024-55636

Drupal Core contains a chain of methods (called a gadget chain) that becomes vulnerable to exploitation when another vulnerability exists in the application that enables deserialization of untrusted data. The gadget chain itself does not pose a direct threat; however, it is a vector that enables RCE if the application deserializes data from an untrusted source due to an additional vulnerability. The mechanism is based on CWE-915 (improperly controlled mass property assignment) and CWE-502 (deserialization of untrusted data).

An attacker can achieve remote code execution (RCE) on the server, which can consequently lead to complete takeover of the application, breach of confidentiality, integrity, and availability of data.

Drupal Core should be updated to version 10.2.11, 10.3.9, or 11.0.8 in accordance with the official security advisory from the vendor available at https://www.drupal.org/sa-core-2024-006

Drupal Core in versions: from 8.0.0 to 10.2.10 (before 10.2.11), from 10.3.0 to 10.3.8 (before 10.3.9), from 11.0.0 to 11.0.7 (before 11.0.8)