GitHub Advisoryadvisory · Packagist

GHSA-7cwc-fjqm-8vh8 Drupal core Access bypass

MEDIUM Published 2024-12-10 Modified 2024-12-10 Official page ↗
Aliases
CVE-2024-55634
Ecosystem
Packagist
Packages
drupal/core, drupal/core-recommended, drupal/drupal
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-178
Reviewed
2024-12-10

Affected packages

• Packagist drupal/core: >= 8.0.0, < 10.2.11 → fixed in 10.2.11 • Packagist drupal/core: >= 10.3.0, < 10.3.9 → fixed in 10.3.9 • Packagist drupal/core: >= 11.0.0, < 11.0.8 → fixed in 11.0.8 • Packagist drupal/core-recommended: >= 8.0.0, < 10.2.11 → fixed in 10.2.11 • Packagist drupal/core-recommended: >= 10.3.0, < 10.3.9 → fixed in 10.3.9 • Packagist drupal/core-recommended: >= 11.0.0, < 11.0.8 → fixed in 11.0.8 • Packagist drupal/drupal: >= 8.0.0, < 10.2.11 → fixed in 10.2.11 • Packagist drupal/drupal: >= 10.3.0, < 10.3.9 → fixed in 10.3.9 • Packagist drupal/drupal: >= 11.0.0, < 11.0.8 → fixed in 11.0.8

Description

Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues. This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Related

Alias · CVE (1)

  • CVE-2024-55634 A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before… vulnerability

Weakness · CWE (1)

  • CWE-178 Improper Handling of Case Sensitivity weakness

References