PT-2024-10230 · Drupal · Drupal Mailjet

Bohdan Artemchuk + 1 · CVE-2024-13296 · Published 2024-11-20 · Updated 2025-01-10

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Drupal Mailjet versions 0.0.0 through 4.0.0

Description The issue is related to the deserialization mechanism in the Mailjet module of the Drupal CMS system. It allows for the deserialization of untrusted data, leading to object injection. This can enable a remote attacker to execute arbitrary code.

Recommendations For versions 0.0.0 through 4.0.0, update to version 4.0.1 or later to resolve the issue. As a temporary workaround, consider disabling the deserialization mechanism in the Mailjet module until a patch is available. Restrict access to the Mailjet module to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-00570

CVE-2024-13296

DRUPAL-CONTRIB-2024-062

Affected Products

Drupal Mailjet

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13296.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-13296 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00570 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-13296 · Security Note
• https://twitter.com/VulmonFeeds/status/1877730396244246923 · Twitter Post
• https://drupal.org/sa-contrib-2024-062 · Note
• https://git.drupalcode.org/project/mailjet · Note
• https://drupal.org/project/mailjet · Note
• https://t.me/cvedetector/14936 · Telegram Post
• https://twitter.com/CVEnew/status/1877620679505490359 · Twitter Post