Authorization Flaw in Drupal Open Social Affects Multiple Versions

CVE-2024-13312

What is CVE-2024-13312?

A missing authorization vulnerability in Drupal Open Social permits unauthenticated users to access restricted resources through forceful browsing. This weakness affects specific versions of Open Social, namely from 11.8.0 to 12.3.10 and 12.4.0 to 12.4.9, potentially exposing sensitive functionalities to unauthorized parties. Organizations using these versions should review their configurations and apply necessary updates to safeguard against this risk.

References