Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Project:
Date:
2024-October-23
Vulnerability:
Arbitrary PHP code execution
Affected versions:
<9.3.4 || >=9.4.0 <9.4.2
CVE IDs:
CVE-2024-13288
Description:
This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure.
In certain cases the module doesn't sufficiently sanitize data before passing it to PHP's unserialize() function, which can result in arbitrary code execution.
Solution:
Install the latest version:
- If you use Monster Menus branch 9.4.x, upgrade to monster_menus 9.4.2
- If you use Monster Menus branch 9.3.x, upgrade to monster_menus 9.3.4
Reported By:
- Drew Webber of the Drupal Security Team
Fixed By:
- Drew Webber of the Drupal Security Team
- Dan Wilga
Coordinated By:
- Greg Knaddison of the Drupal Security Team
- Juraj Nemec of the Drupal Security Team
- Drew Webber of the Drupal Security Team
