Skip to content
OpenAdvisories
High WID-SEC-2024-0196 4 CVEs

Drupal: Mehrere Schwachstellen

Published Jan 24, 2024 · Updated Jan 9, 2025 · Revision 2 · de-DE

Summary

Ein anonymer Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 4

  • Critical 9.8
    CVE-2024-13239

    Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003

    Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.5.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • Critical 9.1
    CVE-2024-13241

    Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005

    Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.0.5.

    Drupal Open Social
  • Critical 9.1
    CVE-2024-13242

    Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006

    Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer: *.*.

    Drupal Swift Mailer (abandoned) drupal/swiftmailer Packagist
  • High 7.5
    CVE-2024-13240

    Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004

    Improper Access Control vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.05.

    Drupal Open Social

Revision history

  1. #2

    CVE's ergänzt

  2. #1

    Initiale Fassung

References