PT-2025-2105 · Drupal · Ohdear Integration

Casey + 3 · CVE-2024-13290 · Published 2024-10-30 · Updated 2025-01-14

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OhDear Integration versions 0.0.0 through 2.0.3

Description The issue is related to incorrect authorization in the OhDear Integration module for Drupal, allowing forceful browsing. This can enable a remote attacker to access confidential information.

Recommendations For OhDear Integration versions 0.0.0 through 2.0.3, update to version 2.0.4 or later to resolve the issue.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-01169

CVE-2024-13290

DRUPAL-CONTRIB-2024-056

Affected Products

Ohdear Integration

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13290.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-13290 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13290 · Security Note
• https://bdu.fstec.ru/vul/2025-01169 · Security Note
• https://twitter.com/CVEnew/status/1877620684412821553 · Twitter Post
• https://git.drupalcode.org/project/ohdear_integration · Note
• https://twitter.com/VulmonFeeds/status/1877745757899440574 · Twitter Post
• https://drupal.org/sa-contrib-2024-056 · Note
• https://drupal.org/project/ohdear_integration · Note