Cyber Resilience

CVE-2024-13309

Medium

Published: 09 January 2025

Published
09 January 2025
Modified
28 August 2025
KEV Added
—
Patch
—
CVSS Score v3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0026 50.0th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13309 is a medium-severity Improper Authentication (CWE-287) vulnerability in Login Disable Project Login Disable. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked in the top 50.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1.

CWE(s)
CWE-287

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability enables bypassing login disable protections for existing Drupal user accounts, facilitating the use of valid accounts (T1078) via exploitation of a public-facing application (T1190).

Affected Assets

login disable project
login disable
2.0.0 — 2.1.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-9 Previous Logon Notification
addresses: CWE-287

Detects unauthorized successful logons resulting from improper authentication implementations.

AT-1 Policy and Procedures
addresses: CWE-287

Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.

AT-2 Literacy Training and Awareness
addresses: CWE-287

Security awareness training instructs users on secure authentication practices and avoiding credential compromise.

AT-3 Role-based Training
addresses: CWE-287

Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.

AU-10 Non-repudiation
addresses: CWE-287

Non-repudiation requires strong authentication mechanisms to irrefutably attribute performed actions to specific individuals or processes.

AU-14 Session Audit
addresses: CWE-287

Session content review can reveal authentication bypasses or failures in session establishment.

AU-6 Audit Record Review, Analysis, and Reporting
addresses: CWE-287

Review of authentication-related audit records can detect improper authentication mechanisms or bypasses.

CA-2 Control Assessments
addresses: CWE-287

Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.

References