Drupal Vulnerabilities and Affected Products
Vulnerabilities associated with Open Social.
Products
Clear product- Drupal Core49 vulnerabilities
- Core21 vulnerabilities
- AI (Artificial Intelligence)8 vulnerabilities
- Open Social8 vulnerabilities
- Enterprise MFA - TFA for Drupal6 vulnerabilities
- COOKiES Consent Management4 vulnerabilities
- Drupal4 vulnerabilities
- Drupal Canvas4 vulnerabilities
- Two-factor Authentication (TFA)4 vulnerabilities
- Authenticator Login3 vulnerabilities
- Facets3 vulnerabilities
- Login Disable3 vulnerabilities
- One Time Password3 vulnerabilities
- OpenID Connect / OAuth client3 vulnerabilities
- Tagify3 vulnerabilities
- Access code2 vulnerabilities
- Acquia DAM2 vulnerabilities
- Advanced Content Feedback (aka admin_feedback)2 vulnerabilities
- AI Agents2 vulnerabilities
- Anti-Spam by CleanTalk2 vulnerabilities
- CivicTheme Design System2 vulnerabilities
- Colorbox2 vulnerabilities
- Data-module2 vulnerabilities
- drupal_core2 vulnerabilities
- ECA: Event - Condition - Action2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-48921HIGH | Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13. CWE-352Jun 26, 2025 | CVSS8.8v3.1 | EPSS0.161% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10. CWE-862Mar 31, 2025 | CVSS-v4.0 | EPSS0.382% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10. CWE-862Mar 31, 2025 | CVSS-v4.0 | EPSS0.363% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2024-13312MEDIUM | Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 before 12.4.9. CWE-862Jan 9, 2025 | CVSS5.3v3.1 | EPSS0.303% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13274MEDIUM | Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5. CWE-799Jan 9, 2025 | CVSS5.3v3.1 | EPSS0.362% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13273MEDIUM | Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Open Social allows Cross-Site Scripting (XSS).This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5, from 13.0.0 before 13.0.0-alpha11. CWE-79Jan 9, 2025 | CVSS5.4v3.1 | EPSS0.218% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13241CRITICAL | Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.0.5. CWE-285Jan 9, 2025 | CVSS9.1v3.1 | EPSS0.354% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-13240HIGH | Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004Improper Access Control vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.05. CWE-284Jan 9, 2025 | CVSS7.5v3.1 | EPSS0.375% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |