CVE-2024-13288 - Vulnerability Details - OpenCVE

Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2024-052

History

Fri, 10 Jan 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 09 Jan 2025 20:30:00 +0000

Type	Values Removed	Values Added
Description		Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.
Title		Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052
Weaknesses		CWE-502
References		https://www.drupal.org/sa-contrib-2024-052

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-01-09T20:14:17.954Z

Updated: 2025-01-10T14:51:10.361Z

Reserved: 2025-01-09T18:28:24.381Z

Link: CVE-2024-13288

Vulnrichment

Updated: 2025-01-10T14:50:19.383Z

NVD

Status : Received

Published: 2025-01-09T21:15:26.220

Modified: 2025-01-10T15:15:14.787

Link: CVE-2024-13288

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-13288", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-01-09T18:28:24.381Z", "datePublished": "2025-01-09T20:14:17.954Z", "dateUpdated": "2025-01-10T14:51:10.361Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/monster_menus", "defaultStatus": "unaffected", "product": "Monster Menus", "repo": "https://git.drupalcode.org/project/monster_menus", "vendor": "Drupal", "versions": [{"lessThan": "9.3.4", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "9.4.2", "status": "affected", "version": "9.4.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Drew Webber"}, {"lang": "en", "type": "remediation developer", "value": "Drew Webber"}, {"lang": "en", "type": "remediation developer", "value": "Dan Wilga"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber"}], "datePublic": "2024-10-23T15:45:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.<p>This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.</p>"}], "value": "Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2."}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T20:14:17.954Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2024-052"}], "source": {"discovery": "UNKNOWN"}, "title": "Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-01-10T14:49:48.123940Z", "id": "CVE-2024-13288", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T14:51:10.361Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-13288", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-10T14:49:48.123940Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T14:50:19.383Z"}}], "cna": {"title": "Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Drew Webber"}, {"lang": "en", "type": "remediation developer", "value": "Drew Webber"}, {"lang": "en", "type": "remediation developer", "value": "Dan Wilga"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber"}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/monster_menus", "vendor": "Drupal", "product": "Monster Menus", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "9.3.4", "versionType": "semver"}, {"status": "affected", "version": "9.4.0", "lessThan": "9.4.2", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/monster_menus", "defaultStatus": "unaffected"}], "datePublic": "2024-10-23T15:45:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2024-052"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.", "supportingMedia": [{"type": "text/html", "value": "Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.<p>This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T20:14:17.954Z"}}}, "cveMetadata": {"cveId": "CVE-2024-13288", "state": "PUBLISHED", "dateUpdated": "2025-01-10T14:51:10.361Z", "dateReserved": "2025-01-09T18:28:24.381Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-01-09T20:14:17.954Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}