Drupal 10.1.x < 10.1.8 / 10.2.x < 10.2.2 Drupal Vulnerability (SA-CORE-2024-001)

high Nessus Plugin ID 189124

Language:

Synopsis

A PHP application running on the remote web server is affected by a vulnerability.

Description

According to its self-reported version, the instance of Drupal running on the remote web server is 10.1.x prior to 10.1.8 or 10.2.x prior to 10.2.2. It is, therefore, affected by a vulnerability.

- The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS). Sites that do not use the Comment module are not affected. (SA-CORE-2024-001)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Drupal version 10.1.8 / 10.2.2 or later.

Plugin Details

Severity: High

ID: 189124

File Name: drupal_10_2_2.nasl

Version: 1.2

Type: remote

Family: CGI abuses

Published: 1/17/2024

Updated: 12/16/2024

Configuration: Enable paranoid mode, Enable thorough checks

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/a:drupal:drupal

Required KB Items: installed_sw/Drupal, Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 1/17/2024

Vulnerability Publication Date: 1/17/2024

Reference Information

IAVA: 2024-A-0039-S

Detections

Analytics