GitHub Advisoryadvisory · Packagist

GHSA-xq54-x54m-vcpx Drupal core Denial of Service

HIGH Published 2024-12-05 Modified 2024-12-05 Official page ↗
Aliases
CVE-2024-11941
Ecosystem
Packagist
Packages
drupal/core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-835
Reviewed
2024-12-05

Affected packages

• Packagist drupal/core: >= 10.1.0, < 10.1.8 → fixed in 10.1.8 • Packagist drupal/core: >= 10.2.0, < 10.2.2 → fixed in 10.2.2

Description

The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS). Sites that do not use the Comment module are not affected.

Related

Alias · CVE (1)

  • CVE-2024-11941 A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before… vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References