CVE-2024-13274: Drupal Open Social allows Functionality Misuse
Drupal Open Social allows Functionality Misuse
Other sources
The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not disclose any information to the attacker.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/goalgorilla/open_socialto a version that resolves this vulnerability.Fixed in 13.0.0-alpha11 - Upgrade
Upgrade
composer/goalgorilla/open_socialto a version that resolves this vulnerability.Fixed in 12.4.5 - Upgrade
Upgrade
composer/goalgorilla/open_socialto a version that resolves this vulnerability.Fixed in 12.3.8
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13274?
CVE-2024-13274 is considered a moderate severity vulnerability due to improper control of interaction frequency.
How do I fix CVE-2024-13274?
To fix CVE-2024-13274, upgrade to Open Social version 13.0.0-alpha11 or version 12.4.5 or 12.3.8.
Which versions of Open Social are affected by CVE-2024-13274?
CVE-2024-13274 affects Open Social versions from 0.0.0 before 12.3.8 and from 12.4.0 before 12.4.5.
What type of vulnerability is CVE-2024-13274?
CVE-2024-13274 is an Improper Control of Interaction Frequency vulnerability allowing for functionality misuse.
Who is affected by CVE-2024-13274?
Users of the affected versions of the Open Social platform are vulnerable to CVE-2024-13274.