Incorrect Authorization Vulnerability in Drupal Freelinking Plugin
CVE-2024-13270

4.3MEDIUM

Key Information:

Vendor

Drupal
Status
Freelinking
Vendor
CVE Published:
9 January 2025

What is CVE-2024-13270?

The Freelinking plugin for Drupal is susceptible to an incorrect authorization vulnerability that enables attackers to perform forceful browsing of protected resources. This issue potentially exposes sensitive information and allows unauthorized users to access content they should not be able to view. It is crucial for users of affected versions to update their installations to mitigate the risk associated with this flaw.

Affected Version(s)

Freelinking 0.0.0 < 4.0.1

References

https://www.drupal.org/sa-contrib-2024-034

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

Credit

Matthew Radcliffe
Matthew Radcliffe
Gisle Hannemyr
Greg Knaddison
Damien McKenna
Juraj Nemec
.