Cyber Resilience

CVE-2024-13284

High

Published: 09 January 2025

Published
09 January 2025
Modified
02 September 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13284 is a high-severity CSRF (CWE-352) vulnerability in Drupalgutenberg Gutenberg. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-13284 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Drupal Gutenberg module. This issue affects all versions of the Gutenberg module from 0.0.0 before 2.13.0, as well as versions from 3.0.0 before 3.0.5. The vulnerability was published on 2025-01-09 and carries a CVSS v3.1 base score of 8.8 (High).

The vulnerability can be exploited remotely (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R) and resulting in unchanged scope (S:U). An attacker can trick an authenticated user into performing unintended actions on a Drupal site with the Gutenberg module enabled, potentially achieving high impacts on confidentiality (C:H), integrity (I:H), and availability (A:H).

Drupal's security advisory SA-CONTRIB-2024-048, available at https://www.drupal.org/sa-contrib-2024-048, provides details on the vulnerability.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CSRF vulnerability in Drupal Gutenberg module enables exploitation of public-facing web application to perform unauthorized state-changing actions on behalf of tricked authenticated users with 'use gutenberg' permission.

CVEs Like This One

CVE-2024-37102Shared CWE-352
CVE-2024-37450Shared CWE-352
CVE-2025-23558Shared CWE-352
CVE-2025-68722Shared CWE-352
CVE-2025-31440Shared CWE-352
CVE-2025-23848Shared CWE-352
CVE-2025-22571Shared CWE-352
CVE-2024-53684Shared CWE-352
CVE-2025-23455Shared CWE-352
CVE-2025-22582Shared CWE-352

Affected Assets

drupalgutenberg
gutenberg
≤ 2.13.0 · 3.0.0 — 3.0.5

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates this CSRF vulnerability by requiring identification, reporting, and timely patching of the flaw in Drupal Gutenberg module versions prior to 2.13.0 and 3.0.5.

SC-23 Session Authenticity good match
prevent

Protects the authenticity of communications sessions to prevent attackers from tricking authenticated users into executing unintended actions via forged requests.

SI-10 Information Input Validation good match
prevent

Requires validation of inputs such as anti-CSRF tokens to block forged cross-site requests targeting the Gutenberg module.

References