CVE-2024-13267

Estado: AnalizadaAlta (7.5)—

Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.56%
Percentil entre todas las CVEs puntuadas: 45
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement60 %

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Threat Intelligence Program Privileged Account Management Network Segmentation Disable or Remove Feature or Program Application Isolation and Sandboxing

Tecnologías afectadas (1)

Opigno — Tincan Question Type

CWE

CWE-96

Referencias

https://www.drupal.org/sa-contrib-2024-031

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-13267",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-13267",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-14T17:02:20.307428Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "mlhess@drupal.org",
      "affectedData": [
        {
          "repo": "https://git.drupalcode.org/project/opigno_tincan_question_type",
          "vendor": "Drupal",
          "product": "Opigno TinCan Question Type",
          "versions": [
            {
              "status": "affected",
              "version": "7.x-1.0",
              "lessThan": "7.x-1.3",
              "versionType": "custom"
            }
          ],
          "collectionURL": "https://www.drupal.org/project/opigno_tincan_question_type",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-01-09T20:15:35.470",
  "references": [
    {
      "url": "https://www.drupal.org/sa-contrib-2024-031",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "mlhess@drupal.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "mlhess@drupal.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-96"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de neutralización incorrecta de directivas en código guardado estáticamente ('inyección de código estático') en Drupal Opigno TinCan Question Type permite la inclusión de archivos locales en PHP. Este problema afecta a Opigno TinCan Question Type: desde 7.X-1.0 antes de 7.X-1.3."
    }
  ],
  "lastModified": "2026-06-17T07:01:38.067",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opigno:tincan_question_type:*:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B47C696-F155-40E2-A6A0-D07D58F6F3E0",
              "versionEndExcluding": "7.x-1.3",
              "versionStartIncluding": "7.x-1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org"
}