According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities :

- Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized.

- Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Remote Code Execution. It is not directly exploitable.

- Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Artbitrary File Deletion. It is not directly exploitable.

- Drupal 7 core's Overlay module doesn't safely handle user input, leading to reflected cross-site scripting under certain circumstances. Only sites with the Overlay module enabled are affected by this vulnerability.

- Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues.

- Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects
    Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core
    contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on
    the site. This so-called gadget chain presents no direct threat but is a vector that can be used to
    achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
    (CVE-2024-55638)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.102, 10.2.x prior to 10.2.11, 10.3.x prior to 10.3.9, or 11.x prior to 11.0.8. It is, therefore, affected by multiple vulnerabilities.

  - Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects     Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. (CVE-2024-55638)

  - Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects     Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
    (CVE-2024-55636, CVE-2024-55637)

  - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability     in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 7.0 before 7.102.
    (CVE-2024-55635)

  - A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0     before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. (CVE-2024-55634)

  - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability     in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before     10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. (CVE-2024-12393)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects     Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core     contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on     the site. This so-called gadget chain presents no direct threat but is a vector that can be used to     achieve remote code execution if the application deserializes untrusted data due to another vulnerability.
    (CVE-2024-55638)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
114519	Drupal 11.0.x < 11.0.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/26/2024	11/26/2024	high
114521	Drupal 10.2.x < 10.2.11 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/26/2024	11/26/2024	high
114520	Drupal 10.3.x < 10.3.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/26/2024	11/26/2024	high
114522	Drupal 7.x < 7.102 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/26/2024	11/26/2024	high
415308	SCA: security update for drupal/core, drupal/core-recommended, drupal/drupal (GHSA-gvf2-2f4g-jqf4)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	high
415308	SCA: security update for drupal/core, drupal/core-recommended, drupal/drupal (GHSA-gvf2-2f4g-jqf4)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	high
211656	Drupal 7.x < 7.102 / 10.2.x < 10.2.11 / 10.3.x < 10.3.9 / 11.x < 11.0.8 Multiple Vulnerabilities (drupal-2024-11-20)	Nessus	CGI abuses	11/20/2024	2/28/2025	critical
250081	Linux Distros Unpatched Vulnerability : CVE-2024-55638	Nessus	Misc.	8/15/2025	7/25/2026	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

critical

critical