CVE-2024-55635: 
Drupal vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was identified in Drupal Core, tracked as CVE-2024-55635. The vulnerability affects Drupal Core versions from 7.0 before 7.102. The issue was disclosed on December 9, 2024, and involves improper neutralization of input during web page generation (NVD).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation vulnerability (CWE-79). The CVSS v3.1 base score is 6.1 (MEDIUM), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, but does require user interaction (CISA-ADP).

The vulnerability allows attackers to perform Cross-Site Scripting (XSS) attacks against users of affected Drupal Core installations. This could potentially lead to unauthorized access to user data, session hijacking, or execution of malicious scripts in the context of the user's browser (NVD).

Users of affected versions should upgrade to Drupal Core version 7.102 or later to address this vulnerability. This is the primary mitigation strategy recommended to protect against potential XSS attacks (NVD).