Cyber Posture

CVE-2024-13277

Critical

Published: 09 January 2025

Published
09 January 2025
Modified
02 September 2025
KEV Added
Patch
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0016 37.1th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2024-13277 is an Incorrect Authorization vulnerability (CWE-863) in the Drupal Smart IP Ban module that allows forceful browsing. This issue affects Smart IP Ban versions from 7.x-1.0 up to but not including 7.x-1.1.

The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning unauthenticated remote attackers require only network access and low attack complexity with no user interaction. Exploitation enables high-impact compromise of confidentiality and integrity, such as unauthorized access to sensitive data or modification of resources, while availability remains unaffected.

The Drupal security advisory SA-CONTRIB-2024-041 at https://www.drupal.org/sa-contrib-2024-041 provides details on the vulnerability and mitigation, which involves updating to Smart IP Ban version 7.x-1.1 or later.

Details

CWE(s)
CWE-863

Affected Products

smart ip ban project
smart ip ban
7.x-1.0 — 7.x-1.1

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Incorrect authorization vulnerability in Drupal Smart IP Ban module enables forceful browsing to bypass access controls on public-facing web application paths, allowing unauthorized viewing and modification of IP ban settings.

References