CVE-2024-13280 Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044
Attackers can bypass session expiration to maintain unauthorized access to user accounts in the Drupal Persistent Login module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-13280?
CVE-2024-13280 is a critical authentication bypass vulnerability in Drupal Persistent Login, published on 9 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2.
Weakness: CWE-613
Which versions are affected by CVE-2024-13280?
It affects 1 product.
Linux distribution packages (1)
drupal/persistent_login Packagist:https://packages.drupal.org/8 | All versions | 1.8.0, 2.2.2, 2.1.0, 2.2.0 |
Products include Persistent Login Project Persistent Login.
How do I fix CVE-2024-13280?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-13280 being exploited?
There is no known exploitation of CVE-2024-13280 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2024-044, GHSA-9q24-c9h6-h244.