CVE-2024-13241
EPSS 0.34%
Description
Open Social is a Drupal distribution for online communities. The included optional social\_group\_flexible\_group module doesn't sufficiently validate group updates. The lack of validation makes it possible to have content inside the group changing it's visibility, which could lead to that content being shown to a broader audience than intended. This vulnerability is mitigated by the fact the module social\_group\_flexible\_group needs to be enabled.
How to fix CVE-2024-13241
To remediate CVE-2024-13241, upgrade the affected package to a fixed version below.
- Packagist/drupal/social—upgrade to 12.0.5 or later
Is CVE-2024-13241 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 12.0.5