CVE-2024-13281 Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045
Attackers can bypass authorization to access restricted content in the Monster Menus Drupal module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-13281?
CVE-2024-13281 is a critical missing authorization vulnerability in Drupal Monster Menus, published on 9 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2.
Weakness: CWE-863
Which versions are affected by CVE-2024-13281?
It affects 1 product.
Linux distribution packages (1)
drupal/monster_menus Packagist:https://packages.drupal.org/8 | All versions | 9.3.2 |
Products include Monster Menus Project Monster Menus.
How do I fix CVE-2024-13281?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-13281 being exploited?
There is no known exploitation of CVE-2024-13281 in the wild and no public exploit code.
Other vulnerabilities in Drupal Monster Menus
- CVE-2026-81201 Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116
- CVE-2013-4230 Missing authorization in n/a
- CVE-2015-8095 Information disclosure in n/a
- CVE-2024-13288 Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052
- CVE-2013-4504 Information disclosure in n/a
Sources
Also known as DRUPAL-CONTRIB-2024-045, GHSA-x5v3-33m6-c266.