CVE-2024-13246 - Vulnerability Details - OpenCVE

Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2024-010

History

Fri, 10 Jan 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 09 Jan 2025 19:00:00 +0000

Type	Values Removed	Values Added
Description		Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.
Title		Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010
Weaknesses		CWE-282
References		https://www.drupal.org/sa-contrib-2024-010

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-01-09T18:52:31.142Z

Updated: 2025-01-10T19:34:34.972Z

Reserved: 2025-01-09T18:27:08.198Z

Link: CVE-2024-13246

Vulnrichment

Updated: 2025-01-10T19:34:22.512Z

NVD

Status : Awaiting Analysis

Published: 2025-01-09T19:15:18.497

Modified: 2025-01-10T20:15:30.297

Link: CVE-2024-13246

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-13246", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-01-09T18:27:08.198Z", "datePublished": "2025-01-09T18:52:31.142Z", "dateUpdated": "2025-01-10T19:34:34.972Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/node_access_rebuild_progressive", "defaultStatus": "unaffected", "product": "Node Access Rebuild Progressive", "repo": "https://git.drupalcode.org/project/node_access_rebuild_progressive", "vendor": "Drupal", "versions": [{"lessThan": "2.0.2", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff"}, {"lang": "en", "type": "remediation developer", "value": "Pierre Rudloff"}, {"lang": "en", "type": "remediation developer", "value": "Shelane French"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "Damien McKenna"}], "datePublic": "2024-02-21T16:58:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.<p>This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.</p>"}], "value": "Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2."}], "impacts": [{"capecId": "CAPEC-425", "descriptions": [{"lang": "en", "value": "CAPEC-425 Target Influence via Framing"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-282", "description": "CWE-282 Improper Ownership Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T18:52:31.142Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2024-010"}], "source": {"discovery": "UNKNOWN"}, "title": "Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-01-10T19:33:29.176989Z", "id": "CVE-2024-13246", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T19:34:34.972Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-13246", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-10T19:33:29.176989Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T19:34:22.512Z"}}], "cna": {"title": "Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Pierre Rudloff"}, {"lang": "en", "type": "remediation developer", "value": "Pierre Rudloff"}, {"lang": "en", "type": "remediation developer", "value": "Shelane French"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "Damien McKenna"}], "impacts": [{"capecId": "CAPEC-425", "descriptions": [{"lang": "en", "value": "CAPEC-425 Target Influence via Framing"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/node_access_rebuild_progressive", "vendor": "Drupal", "product": "Node Access Rebuild Progressive", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2.0.2", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/node_access_rebuild_progressive", "defaultStatus": "unaffected"}], "datePublic": "2024-02-21T16:58:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2024-010"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.", "supportingMedia": [{"type": "text/html", "value": "Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.<p>This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-282", "description": "CWE-282 Improper Ownership Management"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T18:52:31.142Z"}}}, "cveMetadata": {"cveId": "CVE-2024-13246", "state": "PUBLISHED", "dateUpdated": "2025-01-10T19:34:34.972Z", "dateReserved": "2025-01-09T18:27:08.198Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-01-09T18:52:31.142Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}