CVE-2024-13277
Published: 09 January 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2024-13277 is an Incorrect Authorization vulnerability (CWE-863) in the Drupal Smart IP Ban module that allows forceful browsing. This issue affects Smart IP Ban versions from 7.x-1.0 up to but not including 7.x-1.1.
The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning unauthenticated remote attackers require only network access and low attack complexity with no user interaction. Exploitation enables high-impact compromise of confidentiality and integrity, such as unauthorized access to sensitive data or modification of resources, while availability remains unaffected.
The Drupal security advisory SA-CONTRIB-2024-041 at https://www.drupal.org/sa-contrib-2024-041 provides details on the vulnerability and mitigation, which involves updating to Smart IP Ban version 7.x-1.1 or later.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Incorrect authorization vulnerability in Drupal Smart IP Ban module enables forceful browsing to bypass access controls on public-facing web application paths, allowing unauthorized viewing and modification of IP ban settings.