CVE-2024-13265
Published: 09 January 2025
Summary
CVE-2024-13265 is a high-severity Static Code Injection (CWE-96) vulnerability in Opigno Learning Path. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and correction of known flaws such as this static code injection vulnerability in the Drupal Opigno Learning path module via patching to version 3.1.2 or later.
Mandates validation of information inputs at defined points to neutralize directives in statically saved code, preventing PHP local file inclusion exploits.
Requires scanning for vulnerabilities like CVE-2024-13265 in Drupal modules to identify and prioritize remediation of affected systems.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables arbitrary PHP code execution via authenticated file upload in Drupal module, exploiting public-facing web application (T1190) and allowing deployment/execution of web shells (T1100, T1505.003).
NVD Description
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.
Deeper analysisAI
CVE-2024-13265 is an Improper Neutralization of Directives in Statically Saved Code vulnerability, known as 'Static Code Injection' (CWE-96), in the Drupal Opigno Learning path module. This flaw allows PHP Local File Inclusion and affects all versions of Opigno Learning path from 0.0.0 before 3.1.2.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). A low-privileged authenticated user can exploit it remotely over the network, though it requires high attack complexity and no additional user interaction. Successful exploitation can result in high impacts to confidentiality, integrity, and availability.
Drupal's security advisory SA-CONTRIB-2024-029 (https://www.drupal.org/sa-contrib-2024-029) documents the issue, with mitigation achieved by upgrading Opigno Learning path to version 3.1.2 or later.
Details
- CWE(s)