CVE-2024-13291 - Vulnerability Details - OpenCVE

Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2024-057

History

Fri, 10 Jan 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 09 Jan 2025 20:30:00 +0000

Type	Values Removed	Values Added
Description		Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.
Title		Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057
Weaknesses		CWE-863
References		https://www.drupal.org/sa-contrib-2024-057

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-01-09T20:16:29.195Z

Updated: 2025-01-10T18:18:04.099Z

Reserved: 2025-01-09T18:28:27.172Z

Link: CVE-2024-13291

Vulnrichment

Updated: 2025-01-10T18:17:43.853Z

NVD

Status : Awaiting Analysis

Published: 2025-01-09T21:15:26.563

Modified: 2025-01-10T19:15:37.227

Link: CVE-2024-13291

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-13291", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-01-09T18:28:27.172Z", "datePublished": "2025-01-09T20:16:29.195Z", "dateUpdated": "2025-01-10T18:18:04.099Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/basic_auth", "defaultStatus": "unaffected", "product": "Basic HTTP Authentication", "repo": "https://git.drupalcode.org/project/basic_auth", "vendor": "Drupal", "versions": [{"lessThan": "7.x-1.4", "status": "affected", "version": "7.x-1.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Roderik Muit"}, {"lang": "en", "type": "remediation developer", "value": "Roderik Muit"}, {"lang": "en", "type": "remediation developer", "value": "Ivo Van Geertruyen"}, {"lang": "en", "type": "coordinator", "value": "Ivo Van Geertruyen"}], "datePublic": "2024-11-06T16:17:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.<p>This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.</p>"}], "value": "Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4."}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T20:16:29.195Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2024-057"}], "source": {"discovery": "UNKNOWN"}, "title": "Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-01-10T18:17:23.386087Z", "id": "CVE-2024-13291", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T18:18:04.099Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-13291", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-10T18:17:23.386087Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T18:17:43.853Z"}}], "cna": {"title": "Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Roderik Muit"}, {"lang": "en", "type": "remediation developer", "value": "Roderik Muit"}, {"lang": "en", "type": "remediation developer", "value": "Ivo Van Geertruyen"}, {"lang": "en", "type": "coordinator", "value": "Ivo Van Geertruyen"}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/basic_auth", "vendor": "Drupal", "product": "Basic HTTP Authentication", "versions": [{"status": "affected", "version": "7.x-1.0", "lessThan": "7.x-1.4", "versionType": "custom"}], "collectionURL": "https://www.drupal.org/project/basic_auth", "defaultStatus": "unaffected"}], "datePublic": "2024-11-06T16:17:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2024-057"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.", "supportingMedia": [{"type": "text/html", "value": "Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.<p>This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T20:16:29.195Z"}}}, "cveMetadata": {"cveId": "CVE-2024-13291", "state": "PUBLISHED", "dateUpdated": "2025-01-10T18:18:04.099Z", "dateReserved": "2025-01-09T18:28:27.172Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-01-09T20:16:29.195Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}