PT-2025-2103 · Drupal · Drupal Monster Menus

Dan Wilga + 3 · Published 2024-10-23 · Updated 2025-09-02 · CVE-2024-13288

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Monster Menus versions 0.0.0 through 9.3.3 Drupal Monster Menus versions 9.4.0 through 9.4.1

Description The issue is related to the deserialization of untrusted data, which allows object injection. This can potentially enable a remote attacker to execute arbitrary code.

Recommendations For versions 0.0.0 through 9.3.3, update to version 9.3.4 or later. For versions 9.4.0 through 9.4.1, update to version 9.4.2 or later.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-01166

CVE-2024-13288

DRUPAL-CONTRIB-2024-052

Affected Products

Drupal Monster Menus

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-13288 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13288 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01166 · Security Note
• https://drupal.org/sa-contrib-2024-052 · Note
• https://twitter.com/CVEnew/status/1877620685981495627 · Twitter Post
• https://t.me/cveNotify/134116 · Telegram Post