CVE-2024-13312

Name of the Vulnerable Software and Affected Versions Open Social versions 11.8.0 through 12.3.10 Open Social versions 12.4.0 through 12.4.9

Description The issue is related to a lack of authorization in Drupal Open Social, which allows forceful browsing. This problem can be exploited by a remote attacker to bypass security restrictions and perform a forceful browsing attack.

Recommendations For versions 11.8.0 through 12.3.10, update to a version after 12.3.10 to resolve the issue. For versions 12.4.0 through 12.4.9, update to a version after 12.4.9 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of Open Social to minimize the risk of exploitation.