CVE-2024-13246 Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010
An improper ownership management flaw in the Drupal Node Access Rebuild Progressive module allows attackers to bypass access controls via framing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-13246?
CVE-2024-13246 is a medium-severity missing authorization vulnerability in Drupal Node Access Rebuild Progressive, published on 9 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.
Weakness: CWE-282
Which versions are affected by CVE-2024-13246?
It affects 1 product.
Linux distribution packages (1)
drupal/node_access_rebuild_progressive Packagist:https://packages.drupal.org/8 | All versions | 2.0.2 |
Products include Node Access Rebuild Progressive Project Node Access Rebuild Progressive.
How do I fix CVE-2024-13246?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-13246 being exploited?
There is no known exploitation of CVE-2024-13246 in the wild and no public exploit code.
Other vulnerabilities in Drupal Node Access Rebuild Progressive
Sources
Also known as DRUPAL-CONTRIB-2024-010, GHSA-9m7f-2xgc-3w9v.