PT-2024-10092 · Drupal · Pages Restriction Access+1

Damien Mckenna + 4 · Published 2024-12-04 · Updated 2025-01-10 · CVE-2024-13302

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal Pages Restriction Access versions 2.0.0 through 2.0.2

Description The issue is related to an incorrect authorization mechanism in the Pages Restriction Access module of the Drupal CMS system. This allows a remote attacker to bypass security restrictions and perform a forceful browsing attack. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions 2.0.0 through 2.0.2, update to version 2.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Pages Restriction Access module until a patch is available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-00266

CVE-2024-13302

DRUPAL-CONTRIB-2024-068

Affected Products

Drupal

Pages Restriction Access

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-13302 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13302 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00266 · Security Note
• https://t.me/cvedetector/14934 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1877715035474002192 · Twitter Post
• https://drupal.org/sa-contrib-2024-068 · Note
• https://twitter.com/CVEnew/status/1877620674468130873 · Twitter Post
• https://vuldb.com/?id.291069 · Note