{"id":"CVE-2024-11942","aliases":["BIT-drupal-2024-11942","DRUPAL-CORE-2024-002","EUVD-2024-3428","GHSA-52jr-x6h6-xj6g","UBUNTU-CVE-2024-11942"],"status":"published","title":"Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002","description":"A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00385,"percentile":0.32986,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-390"],"published":"2024-10-16T16:27:27Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"Packagist","package":"drupal/core","fixed_in":["10.2.10"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"drupal","fixed_in":["10.3.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.2.10"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"drupal","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.3.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.2.10"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","10.1.0","10.1.0-alpha1","10.1.0-beta1","10.1.0-rc1","10.1.1","10.1.2","10.1.3","10.1.4","10.1.5","10.1.6","10.1.7","10.1.8","10.2.0","10.2.0-alpha1","10.2.0-beta1","10.2.0-rc1","10.2.1","10.2.2","10.2.3","10.2.4","10.2.5","10.2.6","10.2.7","10.2.8","10.2.9"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.2.10"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","10.1.0","10.1.0-alpha1","10.1.0-beta1","10.1.0-rc1","10.1.1","10.1.2","10.1.3","10.1.4","10.1.5","10.1.6","10.1.7","10.1.8","10.2.0","10.2.0-alpha1","10.2.0-beta1","10.2.0-rc1","10.2.1","10.2.2","10.2.3","10.2.4","10.2.5","10.2.6","10.2.7","10.2.8","10.2.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1","7.26-1ubuntu0.1+esm2","7.26-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.38-1","7.41-1","7.44-1ubuntu1~16.04.0","7.44-1ubuntu1~16.04.0+esm1","7.44-1ubuntu1~16.04.0+esm2","7.44-1ubuntu1~16.04.0+esm3"]}],"products":[{"vendor":"drupal","product":"drupal"},{"vendor":"drupal","product":"drupal core"},{"vendor":"drupal","product":"drupal_core"}],"references":[{"url":"https://www.drupal.org/sa-core-2024-002","tags":["Vendor Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11942","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-52jr-x6h6-xj6g"},{"url":"https://www.drupal.org/project/drupal","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11942.json","tags":["advisory"]},{"url":"https://github.com/drupal/core","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-11942","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-11942","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-11942","title":"Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002","description":"A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.","status":"published","published":"2024-12-05T14:42:07.812Z","modified":"2024-12-05T15:41:56.6Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-390"],"updated_at":"2026-11-02T14:34:19.615831Z"}],"euvd":[{"id":"EUVD-2024-3428","description":"A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.","status":"published","published":"2024-12-05T14:42:07Z","modified":"2024-12-05T15:41:56Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:40.064683Z"}],"ghsa":[{"id":"GHSA-52jr-x6h6-xj6g","title":"Drupal core vulnerable to improper error handling","description":"Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site.\n\nThe issue is mitigated by the fact that several non-default site configurations must exist simultaneously for this to occur.","status":"published","published":"2024-12-05T15:31:02Z","modified":"2024-12-05T19:58:25Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-390"],"updated_at":"2026-11-02T14:38:24.542211Z"}],"nvd":[{"id":"CVE-2024-11942","description":"A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.","status":"published","published":"2024-12-05T15:15:08.457Z","modified":"2026-06-17T06:58:44.577Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-390"],"updated_at":"2026-11-02T14:10:39.434419Z"}],"osv":[{"id":"CVE-2024-11942","title":"Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002","description":"A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.","status":"published","published":"2024-12-05T14:42:07.812Z","modified":"2026-10-28T02:30:45.446462199Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-390"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"GHSA-52jr-x6h6-xj6g","title":"Drupal core vulnerable to improper error handling","description":"Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site.\n\nThe issue is mitigated by the fact that several non-default site configurations must exist simultaneously for this to occur.","status":"published","published":"2024-12-05T15:31:02Z","modified":"2025-12-10T23:40:59.635498Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-390"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"UBUNTU-CVE-2024-11942","description":"A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.","status":"published","published":"2024-12-05T15:15:00Z","modified":"2025-09-08T16:58:57Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"BIT-drupal-2024-11942","title":"Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002","description":"A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.","status":"published","published":"2025-06-03T14:41:02.265Z","modified":"2026-09-08T08:47:03.296736318Z","updated_at":"2026-11-02T15:28:29.563843Z"},{"id":"DRUPAL-CORE-2024-002","description":"Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site.\n\nThe issue is mitigated by the fact that several non-default site configurations must exist simultaneously for this to occur.","status":"published","published":"2024-10-16T16:27:27Z","modified":"2025-12-10T23:40:59.635498Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}