PT-2025-2092 · Drupal · Drupal Smart Ip Ban+1

Damien Mckenna + 3 · CVE-2024-13277 · Published 2024-09-18 · Updated 2025-01-10

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Drupal Smart IP Ban versions 7.X-1.0 through 7.X-1.0

Description The issue is related to insufficient authorization mechanisms in the Smart IP Ban module for the Drupal CMS, allowing a remote attacker to view and modify settings. This can lead to forceful browsing, where an attacker can access and alter configurations without proper authorization.

Recommendations For versions 7.X-1.0, update to version 7.X-1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Smart IP Ban module until a patch is available.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-01215

CVE-2024-13277

Affected Products

Drupal Cms

Drupal Smart Ip Ban

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13277.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-13277 · Security Note
• https://bdu.fstec.ru/vul/2025-01215 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13277 · Vendor Advisory
• https://twitter.com/CVEnew/status/1877620694646997250 · Twitter Post
• https://git.drupalcode.org/project/smart_ip_ban · Note
• https://drupal.org/sa-contrib-2024-041 · Note
• https://drupal.org/project/smart_ip_ban · Note