PT-2024-10087 · Drupal · Drupal Entity Form Steps

Ide Braakman · Published 2024-12-04 · Updated 2025-01-10 · CVE-2024-13305

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Entity Form Steps versions 0.0.0 through 1.1.3

Description The issue is related to improper neutralization of input during web page generation, allowing for Cross-Site Scripting (XSS) attacks. This can enable a remote attacker to conduct XSS attacks.

Recommendations For versions 0.0.0 through 1.1.3, update to version 1.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Entity Form Steps module to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-00261

CVE-2024-13305

DRUPAL-CONTRIB-2024-071

Affected Products

Drupal Entity Form Steps

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-13305 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13305 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00261 · Security Note
• https://t.me/cvedetector/14928 · Telegram Post
• https://twitter.com/CVEnew/status/1877620671804797308 · Twitter Post
• https://drupal.org/sa-contrib-2024-071 · Note
• https://vuldb.com/?id.291060 · Note
• https://twitter.com/VulmonFeeds/status/1877707354902344092 · Twitter Post