Cyber Resilience

CVE-2024-13281

Critical

Published: 09 January 2025

Published
09 January 2025
Modified
02 September 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0022 45.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13281 is a critical-severity Incorrect Authorization (CWE-863) vulnerability in Monster Menus Project Monster Menus. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-13281 is an Incorrect Authorization vulnerability (CWE-863) in the Drupal Monster Menus module that allows forceful browsing. It affects all versions of Monster Menus from 0.0.0 before 9.3.2.

The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating network accessibility, low attack complexity, no required privileges or user interaction, and unchanged scope. Remote unauthenticated attackers can exploit it to achieve high impacts on confidentiality and integrity, with no availability disruption.

The Drupal security advisory at https://www.drupal.org/sa-contrib-2024-045 details the issue, and mitigation requires updating Monster Menus to version 9.3.2 or later.

EU & UK References

Vulnerability details

Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2.

CWE(s)
CWE-863

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Incorrect authorization vulnerability (CVE-2024-13281) in Drupal Monster Menus enables forceful browsing and access bypass for information disclosure, facilitating exploitation of a public-facing web application.

CVEs Like This One

CVE-2025-21565Shared CWE-863
CVE-2026-46823Shared CWE-863
CVE-2026-44260Shared CWE-863
CVE-2024-13277Shared CWE-863
CVE-2025-30743Shared CWE-863
CVE-2026-30947Shared CWE-863
CVE-2026-34453Shared CWE-863
CVE-2025-54253Shared CWE-863
CVE-2026-34646Shared CWE-863
CVE-2025-10611Shared CWE-863

Affected Assets

monster menus project
monster menus
≤ 7.x-1.34 · 9.3.0 — 9.3.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the CVE by requiring timely identification, reporting, and patching of the incorrect authorization flaw in Drupal Monster Menus to version 9.3.2 or later.

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations to prevent remote unauthenticated attackers from forcefully browsing and accessing protected resources via missing checks.

RA-5 Vulnerability Monitoring and Scanning partial match
preventdetect

Monitors and scans for vulnerabilities like this authorization flaw in Drupal modules, enabling detection and remediation before exploitation.

References