CVE-2024-13265
Opigno Learning Path ≤ 3.1.2
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-13265 is a high-severity Static Code Injection (CWE-96) vulnerability in Opigno Learning Path. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-13265 is an Improper Neutralization of Directives in Statically Saved Code vulnerability, known as 'Static Code Injection' (CWE-96), in the Drupal Opigno Learning path module. This flaw allows PHP Local File Inclusion and affects all versions of Opigno Learning path from 0.0.0 before 3.1.2.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). A low-privileged authenticated user can exploit it remotely over the network, though it requires high attack complexity and no additional user interaction. Successful exploitation can result in high impacts to confidentiality, integrity, and availability.
Drupal's security advisory SA-CONTRIB-2024-029 (https://www.drupal.org/sa-contrib-2024-029) documents the issue, with mitigation achieved by upgrading Opigno Learning path to version 3.1.2 or later.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51479
Vulnerability Data
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.3.2
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing neutralization of directives in saved code artifacts.
Input validation directly stops unneutralized directives from being inserted into static code resources.
Engineering principles include secure input handling and neutralization requirements that structurally avoid static injection.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization to block static code injection into templates, configs, or libraries.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance will detect static code injection but does not prevent it at the source.
Secure development life cycle mandates input validation and sanitization that directly prevents static code injection.
Application security requirements include rules for neutralizing untrusted input before it is stored in executable resources.
Secure architecture principles reduce injection surfaces but do not prescribe the specific neutralization techniques.
Secure coding explicitly requires proper neutralization of directives in templates, libraries and configuration files.
Change management can catch unsafe code changes but does not enforce input neutralization.