Critical
Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007
Type: advisorySources: OSV
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-55637
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 02:34 UTC · Revision 1
Source evidence
Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007
core-osv · Original sourcePublished 9 Dec 2024, 23:25 UTC
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
osv:CVE-2024-55637
Complete source record
{
"id": "f3087dd0fef57ac6f85253f1dae9ff0231e058b06053e016b0a0b270fd7021dc",
"url": "https://osv.dev/vulnerability/CVE-2024-55637",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007",
"summary": "Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.",
"evidence": "osv:CVE-2024-55637",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2024-55637",
"aliases": [
"BIT-drupal-2024-55637",
"CVE-2024-55637",
"DRUPAL-CORE-2024-007",
"GHSA-w6rx-9g2x-mg5g"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.drupalcode.org/project/drupal",
"type": "GIT",
"events": [
{
"introduced": "35c2f3ca5c935f3d8bde15932a712677c9bbd50f"
},
{
"fixed": "2570b33d6e36d5835119b683af0d6a866593276b"
},
{
"introduced": "150df8b6d02131a72a34ec1cb5444c191ae5e407"
},
{
"fixed": "f2093af42504324a1f55ca1783eab5b8a93afaa0"
},
{
"introduced": "140f94ff1051644c4416c7ed30cc5dd1f14507b2"
},
{
"fixed": "3712d59414f556474f990a503c3f7c295f8c719f"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0"
},
{
"fixed": "10.2.11"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "10.3.0"
},
{
"fixed": "10.3.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.0.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
},
{
"repo": "https://github.com/drupal/drupal",
"type": "GIT",
"events": [
{
"introduced": "35c2f3ca5c935f3d8bde15932a712677c9bbd50f"
},
{
"fixed": "2570b33d6e36d5835119b683af0d6a866593276b"
},
{
"introduced": "150df8b6d02131a72a34ec1cb5444c191ae5e407"
},
{
"fixed": "f2093af42504324a1f55ca1783eab5b8a93afaa0"
},
{
"introduced": "140f94ff1051644c4416c7ed30cc5dd1f14507b2"
},
{
"fixed": "3712d59414f556474f990a503c3f7c295f8c719f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0"
},
{
"fixed": "10.2.11"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.3.0"
},
{
"fixed": "10.3.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.0.8"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"10.2.10",
"10.3.8",
"11.0.7",
"10.3.7",
"11.0.6",
"10.2.9",
"10.3.6",
"11.0.5",
"10.3.5",
"11.0.4",
"10.2.8",
"10.3.4",
"11.0.3",
"10.3.3",
"11.0.2",
"10.3.2",
"11.0.1",
"11.0.0",
"10.3.1",
"10.2.7",
"10.3.0-rc1",
"10.3.0-beta1",
"10.2.6",
"10.2.5",
"10.2.4",
"10.2.3",
"10.2.1",
"10.2.0",
"10.2.0-rc1",
"10.2.0-beta1",
"10.2.0-alpha1",
"10.1.0-alpha1",
"10.0.0-alpha5",
"10.0.0-alpha4",
"10.0.0-alpha3",
"10.0.0-alpha1",
"9.0.0-alpha2",
"9.0.0-alpha1",
"8.1.0-beta1",
"8.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-55637.json"
}
}
],
"modified": "2026-10-28T02:30:46.036286280Z",
"provider": "osv",
"references": [
"https://git.drupalcode.org/project/drupal",
"https://www.drupal.org/project/drupal/",
"https://www.drupal.org/sa-core-2024-007",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55637.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-55637"
],
"provider_metadata": {
"cwe_ids": [
"CWE-915"
],
"cna_assigner": "drupal",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55637.json"
}
},
"related_cves": [
{
"value": "CVE-2024-55637",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 514320,
"published_at": "2024-12-09T23:25:32.356+00:00"
}