CVE-2024-22362

Vulnerability

Overview

CVE-2024-22362 describes an improper handling of structural elements vulnerability (CWE-237) in Drupal. The issue was confirmed in Drupal version 9.3.6, where the software fails to properly manage structural inputs, allowing an attacker to trigger a denial-of-service (DoS) condition [1][2].

Exploitation

Details

The vulnerability is exploitable remotely over the network without any authentication (AV:N/AC:L/PR:N/UI:N/S:U). The attack complexity is low, and no user interaction is required. The attacker can send crafted structural elements to the Drupal instance, causing resource exhaustion or crash [2].

Impact

Successful exploitation leads only to a denial-of-service (DoS) of the Drupal application, with no impact on confidentiality or integrity. The availability impact is rated as low [1][2].

Mitigation

Drupal has confirmed that the vulnerability does not affect the 10.x series or the latest 9.5.x releases. Users are advised to upgrade to Drupal 10.x or the latest 9.5.x. The Drupal 9 series reached end-of-life (EOL) in November 2023, so no further security patches are provided for that branch [2].