PT-2025-2090 · Unknown+1 · Drupal Cms+1

Greg Knaddison + 3 · Published 2024-09-04 · Updated 2025-01-14 · CVE-2024-13274

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Open Social versions 0.0.0 through 12.3.8 Open Social versions 12.4.0 through 12.4.5

Description The issue is related to insufficient control over interaction frequency in the Open Social module of the Drupal CMS system. This can be exploited by a remote attacker to cause a denial of service. The problem allows for misuse of functionality due to improper control of interaction frequency.

Recommendations For Open Social versions 0.0.0 through 12.3.8, update to a version after 12.3.8 to resolve the issue. For Open Social versions 12.4.0 through 12.4.5, update to a version after 12.4.5 to resolve the issue. As a temporary workaround, consider restricting access to the password reset form to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-799

Related Identifiers

BDU:2025-01221

CVE-2024-13274

DRUPAL-CONTRIB-2024-038

GHSA-63WG-87QV-RW4R

Affected Products

Drupal Cms

Open Social

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-13274 · Security Note
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2024-038 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-13274 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-63wg-87qv-rw4r · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01221 · Security Note
• https://github.com/goalgorilla/open_social · Note
• https://twitter.com/CVEnew/status/1877439462214635648 · Twitter Post
• https://t.me/cvedetector/14920 · Telegram Post
• https://drupal.org/sa-contrib-2024-038 · Note