PT-2024-10099 · Drupal · Drupal Registration Role

Benjamin Melanã§On + 5 · Published 2024-03-06 · Updated 2025-01-10 · CVE-2024-13251

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Drupal Registration role versions 0.0.0 through 2.0.0

Description The issue is related to an Incorrect Privilege Assignment vulnerability in the Drupal Registration role, which allows for Privilege Escalation. This vulnerability can be exploited by a remote attacker to bypass security restrictions and elevate their privileges.

Recommendations For versions 0.0.0 through 2.0.0, update to version 2.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Registration role to minimize the risk of exploitation.

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

BDU:2025-00290

CVE-2024-13251

DRUPAL-CONTRIB-2024-015

Affected Products

Drupal Registration Role

References · 6

• https://osv.dev/vulnerability/CVE-2024-13251 · Vendor Advisory
• https://drupal.org/sa-contrib-2024-015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13251 · Security Note
• https://bdu.fstec.ru/vul/2025-00290 · Security Note
• https://t.me/cvedetector/14890 · Telegram Post
• https://twitter.com/CVEnew/status/1877436216016253249 · Twitter Post