Security Resilience

CVE-2024-13274

Getopensocial Open Social ≤ 12.3.8

Published
09 January 2025
Modified
25 August 2025
Patch / advisory
View advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0036 28th percentile
Risk Priority 44 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-13274 is a medium-severity Improper Control of Interaction Frequency (CWE-799) vulnerability in Getopensocial Open Social. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-10 (Concurrent Session Control) and AC-7 (Unsuccessful Logon Attempts) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.

CWE(s)
CWE-799

Related Threats

CVEs Like This One

CVE-2025-48921Same product: Getopensocial Open Social
CVE-2024-13241Same product: Getopensocial Open Social
CVE-2024-13273Same product: Getopensocial Open Social
CVE-2025-31686Same product: Getopensocial Open Social
CVE-2024-13312Same product: Getopensocial Open Social
CVE-2024-13240Same product: Getopensocial Open Social
CVE-2025-31685Same product: Getopensocial Open Social
CVE-2025-48016Shared CWE-799
CVE-2026-7402Shared CWE-799
CVE-2023-2758Shared CWE-799

Affected Assets

getopensocial
open social
≤ 12.3.8 · 12.4.0 — 12.4.5

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-10 Concurrent Session Control good match

ac-10 enforces a hard limit on concurrent sessions per user, directly stopping uncontrolled interaction frequency at the session level.

AC-7 Unsuccessful Logon Attempts good match

ac-7 directly enforces a limit on the frequency of invalid authentication attempts, structurally preventing the weakness for that interaction class.

SC-5 Denial-of-service Protection partial match

sc-5 reduces the impact of excessive request volume (DoS) but does not itself impose the frequency controls whose absence defines the weakness.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.26 Application security requirements partial match
blocks

Application security requirements explicitly include controls on interaction frequency and throttling.

A.8.27 Secure system architecture and engineering principles partial match
blocks

Secure architecture principles recommend rate-limiting and resource-management mechanisms.

A.8.28 Secure coding partial match
prevents

Secure coding practices can embed input-frequency and throttling checks in code.

A.8.6 Capacity management partial match
degrades

Capacity management directly limits request rates and resource exhaustion that CWE-799 describes.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-799, a class-level weakness. Rules are authored against its narrower children: CWE-307.

References