Cyber Resilience

CVE-2024-13253

Critical

Published: 09 January 2025

Published
09 January 2025
Modified
04 June 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS Score 0.0039 60.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13253 is a critical-severity Incorrect Authorization (CWE-863) vulnerability in Advanced Pwa Inc Push Notifications Project Advanced Pwa Inc Push Notifications. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-13253 is an Incorrect Authorization vulnerability (CWE-863) in the Drupal Advanced PWA inc Push Notifications module that allows Forceful Browsing. This issue affects all versions of the module from 0.0.0 before 1.5.0. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and lack of prerequisites like privileges or user interaction.

Remote, unauthenticated attackers can exploit this vulnerability over the network by engaging in forceful browsing. Successful exploitation enables high-impact disruption to integrity and availability, such as unauthorized modifications or denial of service, while confidentiality remains unaffected.

The Drupal security advisory SA-CONTRIB-2024-017 details the vulnerability and recommends upgrading to version 1.5.0 or later of the Advanced PWA inc Push Notifications module as the primary mitigation.

EU & UK References

Vulnerability details

Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0.

CWE(s)
CWE-863

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Incorrect authorization enabling forceful browsing on a public-facing Drupal web module directly matches exploitation of remote public-facing applications for unauthorized access and impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-21565Shared CWE-863
CVE-2026-46823Shared CWE-863
CVE-2026-44260Shared CWE-863
CVE-2024-13277Shared CWE-863
CVE-2025-30743Shared CWE-863
CVE-2026-30947Shared CWE-863
CVE-2026-34453Shared CWE-863
CVE-2025-54253Shared CWE-863
CVE-2026-34646Shared CWE-863
CVE-2025-10611Shared CWE-863

Affected Assets

advanced pwa inc push notifications project
advanced pwa inc push notifications
≤ 8.x-1.5

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mandates timely remediation of the identified flaw in the Drupal Advanced PWA module by upgrading to version 1.5.0 or later, as recommended in the security advisory.

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations for access to system resources, preventing forceful browsing exploits due to incorrect authorization checks.

SI-5 Security Alerts, Advisories, and Directives good match
prevent

Requires obtaining and implementing security advisories like SA-CONTRIB-2024-017 to address the vulnerability before exploitation.

References