Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-55638 is a critical-severity Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) vulnerability in Drupal Drupal. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Drupal Core is affected by a Deserialization of Untrusted Data vulnerability that permits object injection. The issue impacts versions from 7.0 before 7.102, from 8.0.0 before 10.2.11, and from 10.3.0 before 10.3.9. Drupal contains a gadget chain of methods that becomes exploitable when an application deserializes untrusted data, though the chain itself provides no direct attack path.
An unauthenticated remote attacker can supply malicious serialized data to trigger the gadget chain, resulting in remote code execution when combined with a separate deserialization flaw on the site. The vulnerability carries a CVSS score of 9.8 and is associated with CWE-502 and CWE-915.
The Drupal security advisory at https://www.drupal.org/sa-core-2024-008 addresses the issue through updates to the fixed releases listed above. The current EPSS score of 0.0969 with a peak of 0.0993 shows no material rise after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-3473
Vulnerability Data
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core contains a chain of methods that is exploitable when an insecure…
more
deserialization vulnerability exists on the site. This so-called gadget chain presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces authorizations so that only permitted attributes may be modified on an object.
Limits the set of modifiable attributes a subject is authorized to touch.
Developer testing and evaluation can uncover deserialization flaws before deployment.
Validates incoming attribute names and values so that only explicitly allowed fields are accepted for update.
Engineering principles such as safe deserialization and input sanitization structurally prevent the weakness from being introduced.
Integrity verification tools can detect malformed or tampered serialized data after the fact.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require allow-listing of mutable object attributes and input validation to block mass-assignment flaws.
PR.PS-02 addresses only post-deployment updates/patching and cannot prevent introduction of unsafe deserialization code, yet it can remediate some instances when the flaw exists in outdated libraries or components.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards explicitly forbid unsafe dynamic attribute assignment and require property allow-lists.
Security testing can detect mass-assignment flaws but does not itself prevent them at runtime.
Secure development lifecycle requires input validation and object-property whitelisting that directly mitigates mass-assignment risks.
Application security requirements include explicit rules for allowable object attributes and safe deserialization.
Secure architecture principles mandate strict control over dynamic object modification and attribute binding.
Information access restriction limits who can modify objects but does not address which attributes may be changed.