CVE-2024-13264
Opigno Module ≤ 3.1.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-13264 is a critical-severity Static Code Injection (CWE-96) vulnerability in Opigno Opigno Module. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-13264 is an Improper Neutralization of Directives in Statically Saved Code vulnerability, classified as Static Code Injection (CWE-96), in the Drupal Opigno module. This flaw enables PHP Local File Inclusion and affects all versions of the Opigno module from 0.0.0 before 3.1.2.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical. Remote attackers with no authentication or privileges required can exploit it over the network with low attack complexity and no user interaction, achieving high impacts on confidentiality, integrity, and availability through PHP Local File Inclusion, potentially leading to arbitrary code execution.
The Drupal Security Advisory SA-CONTRIB-2024-028 at https://www.drupal.org/sa-contrib-2024-028 provides details on mitigation, including patching to Opigno module version 3.1.2 or later.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51478
Vulnerability Data
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.3.2
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing neutralization of directives in saved code artifacts.
Input validation directly stops unneutralized directives from being inserted into static code resources.
Engineering principles include secure input handling and neutralization requirements that structurally avoid static injection.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization to block static code injection into templates, configs, or libraries.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance will detect static code injection but does not prevent it at the source.
Secure development life cycle mandates input validation and sanitization that directly prevents static code injection.
Application security requirements include rules for neutralizing untrusted input before it is stored in executable resources.
Secure architecture principles reduce injection surfaces but do not prescribe the specific neutralization techniques.
Secure coding explicitly requires proper neutralization of directives in templates, libraries and configuration files.
Change management can catch unsafe code changes but does not enforce input neutralization.