Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Remote Code Execution. It is not directly exploitable. SA-CORE-2024-007
This vulnerability affects the following application versions:
- Drupal 9.4.2
- Drupal 9.4.3
- Drupal 9.4.4
- Drupal 9.4.5
- Drupal 9.4.6
- Drupal 9.4.7
- Drupal 9.4.8
- Drupal 9.4.9
- Drupal 9.4.10
- Drupal 9.4.11
- Drupal 9.4.12
- Drupal 9.4.13
- Drupal 9.4.14
- Drupal 9.4.15
- Drupal 9.5.0
- Drupal 9.5.1
- Drupal 9.5.2
- Drupal 9.5.3
- Drupal 9.5.4
- Drupal 9.5.5
- Drupal 9.5.6
- Drupal 9.5.7
- Drupal 9.5.8
- Drupal 9.5.9
- Drupal 9.5.10
- Drupal 9.5.11
- Drupal 10.0.0
- Drupal 10.0.1
- Drupal 10.0.2
- Drupal 10.0.3
- Drupal 10.0.4
- Drupal 10.0.5
- Drupal 10.0.6
- Drupal 10.0.7
- Drupal 10.0.8
- Drupal 10.0.9
- Drupal 10.0.10
- Drupal 10.0.11
- Drupal 10.1.0
- Drupal 10.1.1
- Drupal 10.1.2
- Drupal 10.1.3
- Drupal 10.1.4
- Drupal 10.1.5
- Drupal 10.1.6
- Drupal 10.1.7
- Drupal 10.1.8
- Drupal 10.2.0
- Drupal 10.2.1
- Drupal 10.2.2
- Drupal 10.2.3
- Drupal 10.2.4
- Drupal 10.2.5
- Drupal 10.2.6
- Drupal 10.2.7
- Drupal 10.2.8
- Drupal 10.2.9
- Drupal 10.2.10
- Drupal 10.3.0
- Drupal 10.3.1
- Drupal 10.3.2
- Drupal 10.3.3
- Drupal 10.3.4
- Drupal 10.3.5
- Drupal 10.3.6
- Drupal 10.3.7
- Drupal 10.3.8
- Drupal 11.0.0
- Drupal 11.0.1
- Drupal 11.0.2
- Drupal 11.0.3
- Drupal 11.0.4
- Drupal 11.0.5
- Drupal 11.0.6
- Drupal 11.0.7