Medium WID-SEC-2024-1258 3 CVEs

Drupal: Mehrere Schwachstellen

Published May 30, 2024 · Updated Jan 9, 2025 · Revision 2 · de-DE

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 3

Critical 9.8

CVE-2024-13258

Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022

Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.

Drupal Drupal REST & JSON API Authentication drupal/rest_api_authentication Web / CMS Packagist

Jan 9, 2025
High 8.8

CVE-2024-13260

Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate queue importer allows Cross Site Request Forgery.This issue affects Migrate queue importer: from 0.0.0 before 2.1.1.

Drupal Migrate queue importer drupal/migrate_queue_importer Packagist

Jan 9, 2025
High 7.5

CVE-2024-13259

Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.

Drupal Image Sizes drupal/image_sizes Packagist

Jan 9, 2025

Revision history

2025-01-09 #2
CVE's ergänzt
2024-05-30 #1
Initiale Fassung

References

Drupal Security Advisory vom 2024-05-30
https://www.drupal.org/sa-contrib-2024-022
Drupal Security Advisory vom 2024-05-30
https://www.drupal.org/sa-contrib-2024-023
Drupal Security Advisory vom 2024-05-30
https://www.drupal.org/sa-contrib-2024-024