CVE-2024-55634: 
PHP vulnerability analysis and mitigation

A privilege escalation vulnerability has been identified in Drupal Core affecting multiple versions: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8. The vulnerability was disclosed on December 9, 2024, and has been assigned CVE-2024-55634 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs low privileges, requires no user interaction, and can result in high impacts to both confidentiality and integrity (NVD).

The vulnerability allows an attacker to escalate their privileges within the Drupal system, potentially gaining unauthorized access to sensitive information and system functions. The CVSS scoring indicates high impacts to both confidentiality and integrity, though availability is not affected (NVD).

Users should upgrade to the following patched versions: Drupal Core 10.2.11, 10.3.9, or 11.0.8, depending on their current version track (NVD).