PT-2024-10355 · Unknown · Open Social

Greg Knaddison + 2 · Published 2024-09-04 · Updated 2025-08-28 · CVE-2024-13273

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Open Social versions 0.0.0 through 12.3.8 Open Social versions 12.4.0 through 12.4.5 Open Social versions 13.0.0 through 13.0.0-alpha11

Description The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting (XSS) attacks. This can enable a remote attacker to conduct inter-site script attacks.

Recommendations For Open Social versions 0.0.0 through 12.3.8, update to a version after 12.3.8 to resolve the issue. For Open Social versions 12.4.0 through 12.4.5, update to a version after 12.4.5 to resolve the issue. For Open Social versions 13.0.0 through 13.0.0-alpha11, update to a version after 13.0.0-alpha11 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-00857

CVE-2024-13273

DRUPAL-CONTRIB-2024-037

Affected Products

Open Social

References · 9

• https://bdu.fstec.ru/vul/2025-00857 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13273 · Vendor Advisory
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2024-037 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13273 · Security Note
• https://t.me/cvedetector/14917 · Telegram Post
• https://t.me/cveNotify/133811 · Telegram Post
• https://twitter.com/CVETracker/status/1877807812614488133 · Twitter Post
• https://drupal.org/sa-contrib-2024-037 · Note
• https://twitter.com/CVEnew/status/1877439463087026574 · Twitter Post