Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Project:
Date:
2024-October-09
Vulnerability:
Cross Site Request Forgery
Affected versions:
<2.13.0 || >=3.0.0 <3.0.5
CVE IDs:
CVE-2024-13284
Description:
This module provides a new UI experience for node editing using the Gutenberg Editor library.
The module did not sufficiently protect some routes against a Cross Site Request Forgery attack.
This vulnerability is mitigated by the fact that the tricked user needs to have an active session with the "use gutenberg" permission.
Solution:
Reported By:
Fixed By:
- Mingsong
- Lee Rowlands of the Drupal Security Team
- Eirik Morland
- Stephan Zeidler
- Cathy Theys of the Drupal Security Team
- codebymikey
- Marco Fernandes
Coordinated By:
- Greg Knaddison of the Drupal Security Team
- Juraj Nemec of the Drupal Security Team
