{ "canonical_id": "drupal--284d6aff2f", "system_id": "drupal", "display_name": "Drupal", "category": "cms", "advisory_mode": "core", "title": "Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002", "summary": "
Project: 
Drupal core
Date: 
2024-October-16
Security risk: 
Moderately critical 13\u2009\u2215\u200925 AC:Basic/A:None/CI:None/II:All/E:Theoretical/TD:Uncommon
Vulnerability: 
Improper error handling
Affected versions: 
>=10.0 < 10.2.10
CVE IDs: 
CVE-2024-11942
Description: 

Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site.

\n

The issue is mitigated by the fact that several non-default site configurations must exist simultaneously for this to occur.

Solution: 

Install the latest version:

\n
    \n
  • If you are using Drupal 10.2, update to Drupal 10.2.10.
    • \n
  • Drupal 10.3 and above are not affected, nor is Drupal 7.
    • \n
\n

All versions of Drupal 10 prior to 10.2 are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

\n

This advisory is not covered by Drupal Steward.

Reported By: 
Fixed By: 
Coordinated By: 
    \n
  • xjm of the Drupal Security Team
    • \n
  • Dave Long of the Drupal Security Team
    • \n
  • Juraj Nemec of the Drupal Security Team
    • \n
", "published_at": "Wed, 16 Oct 2024 16:27:27 +0000", "updated_at": "Wed, 16 Oct 2024 16:27:27 +0000", "severity": "unknown", "cvss_score": null, "exploit_status": "unknown", "source_confidence": "official", "official_source_url": "https://www.drupal.org/sa-core-2024-002", "secondary_source_urls": [], "aliases": [], "cve_ids": [], "ghsa_ids": [], "osv_ids": [], "affected_versions": [], "fixed_versions": [], "package_name": null, "render_markdown": false, "case_path": null, "secure_code_topics": [ "authz-server-side-recheck", "xss-output-encoding", "file-upload-validation", "plugin-extension-trust-policy", "dependency-upgrade-policy" ], "status": "triage", "triage_reasons": [ "missing affected/fixed version details" ], "verification_status": "triage-manual", "verification_mode": "synthetic", "last_verified_at": null, "last_run_id": null, "evidence_bundle": null, "historical_status": null, "latest_status": null, "browser_evidence": { "required": false, "present": false, "refs": [] }, "repro_profile_id": "xss-generic", "artifact_mode": "official-image", "blocked_reason": null, "metadata": { "source_names": [ "Drupal Security Advisories RSS" ], "source_kinds": [ "rss-feed" ], "candidate_count": 1 } }