Improper Authentication Vulnerability in Drupal's Login Disable Plugin
CVE-2024-13309

5.4MEDIUM

Key Information:

Vendor

Drupal
Status
Login Disable
Vendor
CVE Published:
9 January 2025

What is CVE-2024-13309?

The improper authentication vulnerability in the Login Disable plugin for Drupal allows unauthorized users to potentially exploit incorrectly configured access control security levels. This issue affects versions from 2.0.0 up to, but not including, 2.1.1. Administrators should ensure proper configuration of access controls to mitigate potential risks associated with this vulnerability.

Affected Version(s)

Login Disable 2.0.0 < 2.1.1

References

https://www.drupal.org/sa-contrib-2024-073

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

Credit

e5sego
e5sego
Sang Lostrie
Ivo Van Geertruyen
Greg Knaddison
Benji Fisher
.