PT-2024-10354 · Drupal · Node Access Rebuild Progressive

Damien Mckenna + 3 · Published 2024-02-21 · Updated 2025-01-10 · CVE-2024-13246

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Node Access Rebuild Progressive versions 0.0.0 through 2.0.1 Node Access Rebuild Progressive version prior to 2.0.2 can be simplified to the above range, so it is omitted to avoid duplication.

Description The issue is related to improper ownership management in the Node Access Rebuild Progressive module of the Drupal CMS system, which is associated with access control deficiencies. This can allow a remote attacker to bypass security restrictions. The vulnerability may enable an attacker to influence the target via framing.

Recommendations For Node Access Rebuild Progressive versions 0.0.0 through 2.0.1, update to version 2.0.2 or later to resolve the issue. At the moment, there is no other information about additional mitigation measures for this vulnerability.

Fix

Weakness Enumeration

CWE-282

Related Identifiers

BDU:2025-00855

CVE-2024-13246

DRUPAL-CONTRIB-2024-010

Affected Products

Node Access Rebuild Progressive

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-13246 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13246 · Vendor Advisory
• https://drupal.org/sa-contrib-2024-010 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00855 · Security Note
• https://t.me/cvedetector/14895 · Telegram Post
• https://twitter.com/CVEnew/status/1877433103951540382 · Twitter Post