CVE-2024-13258 - Vulnerability Details - OpenCVE

Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2024-022

History

Fri, 10 Jan 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 09 Jan 2025 19:15:00 +0000

Type	Values Removed	Values Added
Description		Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.
Title		Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022
Weaknesses		CWE-863
References		https://www.drupal.org/sa-contrib-2024-022

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-01-09T19:05:29.925Z

Updated: 2025-01-10T16:46:12.472Z

Reserved: 2025-01-09T18:27:53.572Z

Link: CVE-2024-13258

Vulnrichment

Updated: 2025-01-10T16:46:06.000Z

NVD

Status : Awaiting Analysis

Published: 2025-01-09T19:15:19.887

Modified: 2025-01-10T17:15:13.790

Link: CVE-2024-13258

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-13258", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-01-09T18:27:53.572Z", "datePublished": "2025-01-09T19:05:29.925Z", "dateUpdated": "2025-01-10T16:46:12.472Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/rest_api_authentication", "defaultStatus": "unaffected", "product": "Drupal REST & JSON API Authentication", "repo": "https://git.drupalcode.org/project/rest_api_authentication", "vendor": "Drupal", "versions": [{"lessThan": "2.0.13", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Arek Suchecki"}, {"lang": "en", "type": "remediation developer", "value": "solideogloria"}, {"lang": "en", "type": "remediation developer", "value": "Shashank Thigale"}, {"lang": "en", "type": "remediation developer", "value": "Arek Suchecki"}, {"lang": "en", "type": "remediation developer", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}, {"lang": "en", "type": "coordinator", "value": "David Rothstein"}, {"lang": "en", "type": "coordinator", "value": "Michael Hess"}], "datePublic": "2024-05-29T16:44:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.<p>This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.</p>"}], "value": "Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13."}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T19:05:29.925Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2024-022"}], "source": {"discovery": "UNKNOWN"}, "title": "Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-01-10T16:45:04.668466Z", "id": "CVE-2024-13258", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T16:46:12.472Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-13258", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-10T16:45:04.668466Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T16:46:06.000Z"}}], "cna": {"title": "Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Arek Suchecki"}, {"lang": "en", "type": "remediation developer", "value": "solideogloria"}, {"lang": "en", "type": "remediation developer", "value": "Shashank Thigale"}, {"lang": "en", "type": "remediation developer", "value": "Arek Suchecki"}, {"lang": "en", "type": "remediation developer", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}, {"lang": "en", "type": "coordinator", "value": "David Rothstein"}, {"lang": "en", "type": "coordinator", "value": "Michael Hess"}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/rest_api_authentication", "vendor": "Drupal", "product": "Drupal REST & JSON API Authentication", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2.0.13", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/rest_api_authentication", "defaultStatus": "unaffected"}], "datePublic": "2024-05-29T16:44:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2024-022"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.", "supportingMedia": [{"type": "text/html", "value": "Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.<p>This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T19:05:29.925Z"}}}, "cveMetadata": {"cveId": "CVE-2024-13258", "state": "PUBLISHED", "dateUpdated": "2025-01-10T16:46:12.472Z", "dateReserved": "2025-01-09T18:27:53.572Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-01-09T19:05:29.925Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}