CVE-2024-13248 - Vulnerability Details - OpenCVE

Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2024-012

History

Fri, 10 Jan 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 09 Jan 2025 19:00:00 +0000

Type	Values Removed	Values Added
Description		Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.
Title		Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012
Weaknesses		CWE-266
References		https://www.drupal.org/sa-contrib-2024-012

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-01-09T18:53:58.956Z

Updated: 2025-01-10T21:18:54.261Z

Reserved: 2025-01-09T18:27:10.282Z

Link: CVE-2024-13248

Vulnrichment

Updated: 2025-01-10T21:18:47.196Z

NVD

Status : Awaiting Analysis

Published: 2025-01-09T19:15:18.730

Modified: 2025-01-10T22:15:25.360

Link: CVE-2024-13248

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-13248", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-01-09T18:27:10.282Z", "datePublished": "2025-01-09T18:53:58.956Z", "dateUpdated": "2025-01-10T21:18:54.261Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/private_content", "defaultStatus": "unaffected", "product": "Private content", "repo": "https://git.drupalcode.org/project/private_content", "vendor": "Drupal", "versions": [{"lessThan": "2.1.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "kiwimind"}, {"lang": "en", "type": "remediation developer", "value": "Adam Shepherd"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}], "datePublic": "2024-02-28T18:19:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.<p>This issue affects Private content: from 0.0.0 before 2.1.0.</p>"}], "value": "Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0."}], "impacts": [{"capecId": "CAPEC-425", "descriptions": [{"lang": "en", "value": "CAPEC-425 Target Influence via Framing"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-266", "description": "CWE-266 Incorrect Privilege Assignment", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T18:53:58.956Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2024-012"}], "source": {"discovery": "UNKNOWN"}, "title": "Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-01-10T21:17:46.559794Z", "id": "CVE-2024-13248", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T21:18:54.261Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-13248", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-10T21:17:46.559794Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T21:18:47.196Z"}}], "cna": {"title": "Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "kiwimind"}, {"lang": "en", "type": "remediation developer", "value": "Adam Shepherd"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}], "impacts": [{"capecId": "CAPEC-425", "descriptions": [{"lang": "en", "value": "CAPEC-425 Target Influence via Framing"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/private_content", "vendor": "Drupal", "product": "Private content", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2.1.0", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/private_content", "defaultStatus": "unaffected"}], "datePublic": "2024-02-28T18:19:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2024-012"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.", "supportingMedia": [{"type": "text/html", "value": "Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.<p>This issue affects Private content: from 0.0.0 before 2.1.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "CWE-266 Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T18:53:58.956Z"}}}, "cveMetadata": {"cveId": "CVE-2024-13248", "state": "PUBLISHED", "dateUpdated": "2025-01-10T21:18:54.261Z", "dateReserved": "2025-01-09T18:27:10.282Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-01-09T18:53:58.956Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}