CVE-2024-13241

CVE-2024-13241 is an improper authorization vulnerability in the Drupal Open Social distribution that allows attackers to collect data from common resource locations. It affects all versions of Open Social from 0.0.0 up to but not including 12.0.5. The vulnerability has a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to high impacts on confidentiality and integrity with no privileges or user interaction required.

Remote attackers with network access can exploit this vulnerability without authentication, as it requires low complexity and no special privileges. Successful exploitation enables unauthorized data collection from common resource locations, potentially leading to high confidentiality and integrity violations, such as accessing sensitive information or modifying data without proper authorization.

The Drupal Security Advisory at https://www.drupal.org/sa-contrib-2024-005 provides details on the issue. Mitigation involves updating to Open Social version 12.0.5 or later, which resolves the improper authorization flaw.