PT-2025-2092 · Drupal · Drupal Smart Ip Ban+1

Damien Mckenna + 3 · Published 2024-09-18 · Updated 2025-01-10 · CVE-2024-13277

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Drupal Smart IP Ban versions 7.X-1.0 through 7.X-1.0

Description The issue is related to insufficient authorization mechanisms in the Smart IP Ban module for the Drupal CMS, allowing a remote attacker to view and modify settings. This can lead to forceful browsing, where an attacker can access and alter configurations without proper authorization.

Recommendations For versions 7.X-1.0, update to version 7.X-1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Smart IP Ban module until a patch is available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-01215

CVE-2024-13277

Affected Products

Drupal Cms

Drupal Smart Ip Ban

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-13277 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13277 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01215 · Security Note
• https://twitter.com/CVEnew/status/1877620694646997250 · Twitter Post
• https://drupal.org/sa-contrib-2024-041 · Note