A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before     10.2.10. (CVE-2024-11942)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before
    10.2.10. (CVE-2024-11942)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.2.x prior to 10.2.10. Under certain uncommon site configurations, a bug in the CKEditor 5 module can cause some image uploads to move the entire webroot to a different location on the file system. This could be exploited by a malicious user to take down a site.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Drupal running on the remote web server is 10.2.x prior to 10.2.10. It is, therefore, affected by a vulnerability.

  - A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before     10.2.10. (CVE-2024-11942)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
253015	Linux Distros Unpatched Vulnerability : CVE-2024-11942	Nessus	Misc.	medium
410509	SCA: security update for drupal/core (GHSA-52jr-x6h6-xj6g)	Tenable Cloud Security	SCA Checks	medium
410509	SCA: security update for drupal/core (GHSA-52jr-x6h6-xj6g)	Tenable Self-Hosted Container Security	SCA Checks	medium
114456	Drupal 10.2.x < 10.2.10 Improper Error Handling	Web App Scanning	Component Vulnerability	medium
209186	Drupal 10.2.x < 10.2.10 Drupal Vulnerability (SA-CORE-2024-002)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2024-11942

medium

Tenable Plugins

medium

medium

medium

medium

medium