CVE-2024-13278 - Vulnerability Details - OpenCVE

Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Diff Project	Diff

Configuration 1 [-]

OR	cpe:2.3:a:diff_project:diff::::::drupal::*
	cpe:2.3:a:diff_project:diff:2.0.0:-::::drupal::*
	cpe:2.3:a:diff_project:diff:2.0.0:beta1::::drupal::*
	cpe:2.3:a:diff_project:diff:2.0.0:beta2::::drupal::*

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2024-042

History

Tue, 02 Sep 2025 19:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Diff Project Diff Project diff
CPEs		cpe:2.3:a:diff_project:diff::::::drupal::* cpe:2.3:a:diff_project:diff:2.0.0:-::::drupal::* cpe:2.3:a:diff_project:diff:2.0.0:beta1::::drupal::* cpe:2.3:a:diff_project:diff:2.0.0:beta2::::drupal::*
Vendors & Products		Diff Project Diff Project diff

Fri, 10 Jan 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 09 Jan 2025 19:45:00 +0000

Type	Values Removed	Values Added
Description		Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.
Title		Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042
Weaknesses		CWE-863
References		https://www.drupal.org/sa-contrib-2024-042

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-01-09T19:31:12.862Z

Updated: 2025-01-10T16:31:14.194Z

Reserved: 2025-01-09T18:28:13.767Z

Link: CVE-2024-13278

Vulnrichment

Updated: 2025-01-10T16:31:08.605Z

NVD

Status : Analyzed

Published: 2025-01-09T20:15:36.697

Modified: 2025-09-02T18:28:39.523

Link: CVE-2024-13278

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-13278", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-01-09T18:28:13.767Z", "datePublished": "2025-01-09T19:31:12.862Z", "dateUpdated": "2025-01-10T16:31:14.194Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/diff", "defaultStatus": "unaffected", "product": "Diff", "repo": "https://git.drupalcode.org/project/diff", "vendor": "Drupal", "versions": [{"lessThan": "1.8.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Matthias Vogel"}, {"lang": "en", "type": "remediation developer", "value": "Matthias Vogel"}, {"lang": "en", "type": "remediation developer", "value": "Lucas Hedding"}, {"lang": "en", "type": "remediation developer", "value": "Adam Bramley"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}], "datePublic": "2024-10-02T16:15:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.<p>This issue affects Diff: from 0.0.0 before 1.8.0.</p>"}], "value": "Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0."}], "impacts": [{"capecId": "CAPEC-212", "descriptions": [{"lang": "en", "value": "CAPEC-212 Functionality Misuse"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T19:31:12.862Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2024-042"}], "source": {"discovery": "UNKNOWN"}, "title": "Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-01-10T16:30:47.294007Z", "id": "CVE-2024-13278", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T16:31:14.194Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Matthias Vogel"}, {"lang": "en", "type": "remediation developer", "value": "Matthias Vogel"}, {"lang": "en", "type": "remediation developer", "value": "Lucas Hedding"}, {"lang": "en", "type": "remediation developer", "value": "Adam Bramley"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec"}], "impacts": [{"capecId": "CAPEC-212", "descriptions": [{"lang": "en", "value": "CAPEC-212 Functionality Misuse"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/diff", "vendor": "Drupal", "product": "Diff", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.8.0", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/diff", "defaultStatus": "unaffected"}], "datePublic": "2024-10-02T16:15:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2024-042"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.", "supportingMedia": [{"type": "text/html", "value": "Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.<p>This issue affects Diff: from 0.0.0 before 1.8.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-01-09T19:31:12.862Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-13278", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-10T16:30:47.294007Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2025-01-10T16:31:08.605Z"}}]}, "cveMetadata": {"cveId": "CVE-2024-13278", "state": "PUBLISHED", "dateUpdated": "2025-01-09T19:31:12.862Z", "dateReserved": "2025-01-09T18:28:13.767Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-01-09T19:31:12.862Z", "assignerShortName": "drupal"}, "dataVersion": "5.1"}