PT-2025-2089 · Drupal · Content Entity Clone

Greg Knaddison + 3 · Published 2024-09-04 · Updated 2025-08-27 · CVE-2024-13271

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Content Entity Clone versions 0.0.0 through 1.0.4

Description The issue is related to incorrect authorization in the Content Entity Clone module for Drupal, allowing forceful browsing. This can enable a remote attacker to disclose protected information.

Recommendations For versions 0.0.0 through 1.0.4, update to a version newer than 1.0.4 to resolve the issue. As a temporary workaround, consider restricting access to the Content Entity Clone module until a patch is available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-01127

CVE-2024-13271

DRUPAL-CONTRIB-2024-035

Affected Products

Content Entity Clone

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-13271 · Security Note
• https://bdu.fstec.ru/vul/2025-01127 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13271 · Vendor Advisory
• https://twitter.com/CVEnew/status/1877439465750409634 · Twitter Post
• https://t.me/cveNotify/133753 · Telegram Post
• https://drupal.org/sa-contrib-2024-035 · Note