CVE catalog

CVE-2024-55635

UBUNTU-

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 7.0 before 7.102.

Severity: Unknown
Published: Dec 10, 2024, 12:15:00 AM UTC
Updated: Sep 8, 2025, 5:05:36 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.32% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Ubuntupro	drupal7	`7.23-1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.24-1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.24-2`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.26-1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.26-1ubuntu0.1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.26-1ubuntu0.1+esm1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.26-1ubuntu0.1+esm2`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.26-1ubuntu0.1+esm3`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.38-1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.41-1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.44-1ubuntu1~16.04.0`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.44-1ubuntu1~16.04.0+esm1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC

Showing 12 observations. All 14 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Ubuntupro	drupal7	`7.23-1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.24-1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.24-2`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.26-1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.26-1ubuntu0.1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.26-1ubuntu0.1+esm1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.26-1ubuntu0.1+esm2`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.26-1ubuntu0.1+esm3`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.38-1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.41-1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.44-1ubuntu1~16.04.0`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.44-1ubuntu1~16.04.0+esm1`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.44-1ubuntu1~16.04.0+esm2`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC
Ubuntupro	drupal7	`7.44-1ubuntu1~16.04.0+esm3`	Affected	[UBUNTU-CVE-2024-55635]Sep 8, 2025, 5:05:36 PM UTC

Original provider fields

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "drupal7",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "7.23-1",
        "7.24-1",
        "7.24-2",
        "7.26-1",
        "7.26-1ubuntu0.1",
        "7.26-1ubuntu0.1+esm1",
        "7.26-1ubuntu0.1+esm2",
        "7.26-1ubuntu0.1+esm3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-55635",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2024-55635",
      "provider_updated_at": "2025-09-08T17:05:36Z"
    },
    {
      "name": "drupal7",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "7.38-1",
        "7.41-1",
        "7.44-1ubuntu1~16.04.0",
        "7.44-1ubuntu1~16.04.0+esm1",
        "7.44-1ubuntu1~16.04.0+esm2",
        "7.44-1ubuntu1~16.04.0+esm3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-55635",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2024-55635",
      "provider_updated_at": "2025-09-08T17:05:36Z"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed: Oct 27, 2026, 12:32:39 AM UTC

References

[https://osv.dev/vulnerability/UBUNTU-CVE-2024-55635]

[FIRST EPSS] · [OSV Package Vulnerability Database]