« Volver al listado

CVE-2024-13301

Estado: AnalizadaMedia (6.1)—

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client): from 3.0.0 before 3.44.0, from 4.0.0 before 4.0.19.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Miniorange — Oauth & Openid Connect Single Sign-on

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-13301",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-13301",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-10T16:14:55.490223Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "mlhess@drupal.org",
      "affectedData": [
        {
          "repo": "https://git.drupalcode.org/project/miniorange_oauth_client",
          "vendor": "Drupal",
          "product": "OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client)",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0",
              "lessThan": "3.44.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.0.19",
              "versionType": "semver"
            }
          ],
          "collectionURL": "https://www.drupal.org/project/miniorange_oauth_client",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-01-09T21:15:28.000",
  "references": [
    {
      "url": "https://www.drupal.org/sa-contrib-2024-067",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "mlhess@drupal.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "mlhess@drupal.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client): from 3.0.0 before 3.44.0, from 4.0.0 before 4.0.19."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('Cross-site Scripting') en Drupal OAuth y OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) permite Cross-Site Scripting (XSS). Este problema afecta a OAuth y OpenID Connect Single Sign On – SSO (OAuth/OIDC Client): desde 3.0.0 antes de 3.44.0, desde 4.0.0 antes de 4.0.19."
    }
  ],
  "lastModified": "2026-06-17T07:01:43.753",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:miniorange:oauth_\\&_openid_connect_single_sign-on:*:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DFF1C9DC-2D57-4EFE-98E8-E705E44E6602",
              "versionEndExcluding": "3.44.0",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:miniorange:oauth_\\&_openid_connect_single_sign-on:*:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9AEA68FA-E190-42C0-88F1-BFA37C4CEE94",
              "versionEndExcluding": "4.0.19",
              "versionStartIncluding": "4.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org"
}