CVE-2024-55637

In Drupal Core, there exists a chain of methods (so-called gadget chain) which by itself does not pose a direct threat, but becomes an attack vector when the application has a separate vulnerability enabling deserialization of untrusted data. An attacker can inject a crafted object (Object Injection) which will be processed by this chain. This results in the possibility of remote code execution without the need for authentication.

An attacker can achieve full remote code execution (RCE) on the server, which may result in takeover of the application, data theft, or further compromise of the infrastructure.

Drupal Core should be updated to version 10.2.11, 10.3.9, or 11.0.8 (or newer). Detailed information is available in the vendor's security advisory: https://www.drupal.org/sa-core-2024-007

Drupal Core in versions: from 8.0.0 to 10.2.11 (before 10.2.11), from 10.3.0 to 10.3.9 (before 10.3.9), from 11.0.0 to 11.0.8 (before 11.0.8)