CVE-2024-11942
Drupal 10.0.0 – 10.2.10
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-11942 is a medium-severity Detection of Error Condition Without Action (CWE-390) vulnerability in Drupal Drupal. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique LSASS Memory (T1003.001); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-3428
Vulnerability Data
A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation will surface code paths that detect errors yet perform no subsequent action.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Analysis of detected events directly counters ignoring them, but does not guarantee every error condition is covered.
Declaring incidents when criteria are met forces action on detected errors; eliminating the weakness helps but does not define the criteria themselves.
Monitoring produces detections, yet supplies no requirement to act on them.
Generating logs enables later action but does not enforce handling of each error condition.
Root-cause analysis of incidents requires acting on detected anomalies, though it applies after an incident is already declared.
Triaging and validating reports compels follow-up on detections; removing the weakness supports but does not replace triage processes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Logging captures error conditions but does not guarantee subsequent handling or remediation.
Monitoring activities can detect errors, yet without defined response procedures the weakness persists.
Secure development lifecycle practices encourage proper error handling, but do not mandate it for every detected condition.