Cyber Posture

CVE-2024-13278

Critical

Published: 09 January 2025

Published
09 January 2025
Modified
02 September 2025
KEV Added
Patch
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0016 37.1th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may leverage information repositories to mine valuable information.

Security Summary

CVE-2024-13278 is an Incorrect Authorization vulnerability (CWE-863) in the Drupal Diff module that allows Functionality Misuse. It affects all versions of the Diff module from 0.0.0 before 1.8.0. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to its potential for high confidentiality and integrity impacts.

Remote unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation enables functionality misuse, potentially allowing unauthorized access to sensitive data or modifications that compromise the integrity of Drupal sites using the affected Diff module.

The Drupal security advisory SA-CONTRIB-2024-042 at https://www.drupal.org/sa-contrib-2024-042 recommends upgrading to Diff module version 1.8.0 as the primary mitigation. No additional workarounds are specified in available details.

Details

CWE(s)
CWE-863

Affected Products

diff project
diff
2.0.0 · ≤ 1.8.0

MITRE ATT&CK Enterprise Techniques

T1213 Data from Information Repositories Collection
Adversaries may leverage information repositories to mine valuable information.
Why these techniques?

Incorrect authorization in Drupal Diff module enables access bypass for rendering diff reports on restricted revisions of nodes/entities, facilitating unauthorized collection of data from Drupal content repositories.

References