PT-2024-10362 · Drupal · Drupal Cms+1

Drew Webber + 4 · Published 2024-05-22 · Updated 2025-01-10 · CVE-2024-13257

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal Commerce View Receipt versions 0.0.0 through 1.0.2

Description The issue is related to insufficient authorization procedures in the Commerce View Receipt module of the Drupal CMS system. This can allow a remote attacker to bypass security restrictions and perform a forceful browsing attack.

Recommendations For versions 0.0.0 through 1.0.2, update to version 1.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Commerce View Receipt module until a patch is applied.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-00866

CVE-2024-13257

DRUPAL-CONTRIB-2024-021

Affected Products

Drupal Cms

Drupal Commerce View Receipt

References · 6

• https://osv.dev/vulnerability/CVE-2024-13257 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00866 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-13257 · Security Note
• https://drupal.org/sa-contrib-2024-021 · Vendor Advisory
• https://twitter.com/CVEnew/status/1877436211155054857 · Twitter Post
• https://t.me/cvedetector/14887 · Telegram Post