CVE-2024-13274 Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038
Attackers can cause denial of service in Drupal Open Social by exploiting improper control of interaction frequency.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-13274?
CVE-2024-13274 is a medium-severity denial of service vulnerability in Drupal Open Social, published on 9 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.
Weakness: CWE-799
Which versions are affected by CVE-2024-13274?
6 open source packages ship an affected version, including goalgorilla/open_social. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
goalgorilla/open_social Packagist | All versions | 12.3.8 |
goalgorilla/open_social Packagist | All versions | 12.3.8 |
goalgorilla/open_social Packagist | From 12.4.0 | 12.4.5 |
goalgorilla/open_social Packagist | From 12.4.0 | 12.4.5 |
goalgorilla/open_social Packagist | From 13.0.0-alpha1 | 13.0.0-alpha11 |
goalgorilla/open_social Packagist | From 13.0.0-alpha1 | 13.0.0-alpha11 |
Products include Getopensocial Open Social.
How do I fix CVE-2024-13274?
Upgrade goalgorilla/open_social to a fixed version for your release line: 12.3.8, 12.4.5 or 13.0.0-alpha11.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-13274 being exploited?
There is no known exploitation of CVE-2024-13274 in the wild and no public exploit code.
Other vulnerabilities in Drupal Open Social
- CVE-2025-31685 Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014
- CVE-2024-13241 Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005
- CVE-2025-48921 Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079
- CVE-2025-31686 Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015
- CVE-2024-13240 Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004
Sources
Also known as GHSA-63wg-87qv-rw4r.