CVE-2024-13280

Published: Jan 9, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2.

Affected (3)

Products: Persistent Login Project: Persistent Login

Persistent Login Project

1 product

Persistent Login

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Persistent Login Project Persistent Login	Before 1.8.0
Persistent Login Project Persistent Login	From 2.0.0 to 2.1.1
Persistent Login Project Persistent Login	From 2.2.0 to 2.2.2

Related CWEs

CWE-613

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (1)

https://www.drupal.org/sa-contrib-2024-044

Source: mlhess@drupal.org

Third Party Advisory

Timeline

No history available yet.