CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
Explanation of Vulnerability in Simple Terms
Drupal core contains a SQL injection vulnerability in versions 8.9.0 through 10.4.10. An unauthenticated attacker can inject malicious SQL through the database query interface, potentially reading, modifying, or deleting site data. This vulnerability requires no user interaction and can be exploited remotely. Update to version 10.4.10 or later immediately.
What an attacker can do
Execute arbitrary SQL queries to read, modify, or delete database contents without authentication.
Potential impact on your site
Complete compromise of site database: user credentials, content, and configuration can be stolen or destroyed.
Conditions required to exploit
Network access to the Drupal site; no authentication or user interaction required.
CISA mandated remediation
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Key dates
External resources
Related vulnerabilities
