CVE-2024-13249 - Vulnerability Details - OpenCVE

Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 7.X-1.0 before 7.X-1.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2024-013

History

Fri, 10 Jan 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 09 Jan 2025 19:00:00 +0000

Type	Values Removed	Values Added
Description		Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 7.X-1.0 before 7.X-1.2.
Title		Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013
Weaknesses		CWE-282
References		https://www.drupal.org/sa-contrib-2024-013

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-01-09T18:55:21.700Z

Updated: 2025-01-10T21:24:31.894Z

Reserved: 2025-01-09T18:27:11.303Z

Link: CVE-2024-13249

Vulnrichment

Updated: 2025-01-10T21:24:25.387Z

NVD

Status : Awaiting Analysis

Published: 2025-01-09T19:15:18.857

Modified: 2025-01-10T22:15:25.497

Link: CVE-2024-13249

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-13249", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-01-09T18:27:11.303Z", "datePublished": "2025-01-09T18:55:21.700Z", "dateUpdated": "2025-01-10T21:24:31.894Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/node_access_rebuild_progressive", "defaultStatus": "unaffected", "product": "Node Access Rebuild Progressive", "repo": "https://git.drupalcode.org/project/node_access_rebuild_progressive", "vendor": "Drupal", "versions": [{"lessThan": "7.x-1.2", "status": "affected", "version": "7.x-1.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jen Lampton"}, {"lang": "en", "type": "remediation developer", "value": "Shelane French"}, {"lang": "en", "type": "remediation developer", "value": "Juraj Nemec"}, {"lang": "en", "type": "remediation developer", "value": "Jen Lampton"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}], "datePublic": "2024-02-28T18:27:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.<p>This issue affects Node Access Rebuild Progressive: from 7.X-1.0 before 7.X-1.2.</p>"}], "value": "Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 7.X-1.0 before 7.X-1.2."}], "impacts": [{"capecId": "CAPEC-425", "descriptions": [{"lang": "en", "value": "CAPEC-425 Target Influence via Framing"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-282", "description": "CWE-282 Improper Ownership Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T18:55:21.700Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2024-013"}], "source": {"discovery": "UNKNOWN"}, "title": "Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-01-10T21:21:53.646603Z", "id": "CVE-2024-13249", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T21:24:31.894Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-13249", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-10T21:21:53.646603Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T21:24:25.387Z"}}], "cna": {"title": "Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Jen Lampton"}, {"lang": "en", "type": "remediation developer", "value": "Shelane French"}, {"lang": "en", "type": "remediation developer", "value": "Juraj Nemec"}, {"lang": "en", "type": "remediation developer", "value": "Jen Lampton"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}], "impacts": [{"capecId": "CAPEC-425", "descriptions": [{"lang": "en", "value": "CAPEC-425 Target Influence via Framing"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/node_access_rebuild_progressive", "vendor": "Drupal", "product": "Node Access Rebuild Progressive", "versions": [{"status": "affected", "version": "7.x-1.0", "lessThan": "7.x-1.2", "versionType": "custom"}], "collectionURL": "https://www.drupal.org/project/node_access_rebuild_progressive", "defaultStatus": "unaffected"}], "datePublic": "2024-02-28T18:27:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2024-013"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 7.X-1.0 before 7.X-1.2.", "supportingMedia": [{"type": "text/html", "value": "Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.<p>This issue affects Node Access Rebuild Progressive: from 7.X-1.0 before 7.X-1.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-282", "description": "CWE-282 Improper Ownership Management"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T18:55:21.700Z"}}}, "cveMetadata": {"cveId": "CVE-2024-13249", "state": "PUBLISHED", "dateUpdated": "2025-01-10T21:24:31.894Z", "dateReserved": "2025-01-09T18:27:11.303Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-01-09T18:55:21.700Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}