CVE-2024-13274

MEDIUM5.3EPSS 0.24%

Drupal Open Social allows Functionality Misuse

Published: 9/4/2024Modified: 3/18/2026

Also known as:GHSA-63wg-87qv-rw4rDRUPAL-CONTRIB-2024-038

Description

The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not disclose any information to the attacker.

Affected packages (2)

Packagist/drupal/socialfrom 0, < 12.3.8 | >= 12.4.0, < 12.4.5 | >= 13.0.0-alpha1, < 13.0.0-alpha11
Packagist/goalgorilla/open_socialfrom 0, < 12.3.8

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References (3)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-13274
PATCHhttps://github.com/goalgorilla/open_social
WEBhttps://www.drupal.org/sa-contrib-2024-038