CVE-2024-13274
Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038
Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038
Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.
- Record
CVE-2024-13274- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-799
- Updated
- 2026-11-02
EUVDEUVD-2025-0076
Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.
- Record
EUVD-2025-0076- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-63wg-87qv-rw4r
Drupal Open Social allows Functionality Misuse
The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not disclose any information to the attacker.
- Record
GHSA-63wg-87qv-rw4r- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-799
- Updated
- 2026-11-02
NVD
Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.
- Record
CVE-2024-13274- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-799
- Updated
- 2026-11-02
OSV
Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038
Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.
- Record
CVE-2024-13274- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-799
- Updated
- 2026-11-02
OSVGHSA-63wg-87qv-rw4r
Drupal Open Social allows Functionality Misuse
The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not disclose any information to the attacker.
- Record
GHSA-63wg-87qv-rw4r- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-799
- Updated
- 2026-11-02
OSVDRUPAL-CONTRIB-2024-038 No score
Open Social is a Drupal distribution for online communities.
The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not disclose any information to the attacker.
- Record
DRUPAL-CONTRIB-2024-038- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
goalgorilla/open_socialPackagist |
before 12.3.8 | 12.3.8 |
goalgorilla/open_socialPackagist |
12.4.0 up to 12.4.5 | 12.4.5 |
goalgorilla/open_socialPackagist |
13.0.0-alpha1 up to 13.0.0-alpha11 | 13.0.0-alpha11 |
goalgorilla/open_socialPackagist |
before 12.3.8, plus listed versions 1.0.01.0.0-alpha61.0.0-alpha71.0.0-beta11.0.0-beta10 Show 45 moreShow less1.0.0-beta111.0.0-beta121.0.0-beta131.0.0-beta141.0.0-beta21.0.0-beta31.0.0-beta41.0.0-beta51.0.0-beta61.0.0-beta71.0.0-beta81.0.0-beta91.0.0-rc11.0.0-rc21.0.0-rc31.0.0-rc41.0.0-rc51.0.0-rc61.0.0-rc71.0.0-rc81.1.01.10.01.11.01.12.01.13.01.14.01.15.01.16.01.17.01.18.01.19.01.2.01.3.01.4.01.5.01.6.01.7.01.8.01.9.010.0.010.0.110.0.1010.0.1110.0.1210.0.13 |
12.3.8 |
goalgorilla/open_socialPackagist |
12.4.0 up to 12.4.5, plus listed versions 12.4.112.4.212.4.312.4.4 |
12.4.5 |
goalgorilla/open_socialPackagist |
13.0.0-alpha1 up to 13.0.0-alpha11, plus listed versions 13.0.0-alpha1013.0.0-alpha213.0.0-alpha313.0.0-alpha413.0.0-alpha5 Show 4 moreShow less13.0.0-alpha613.0.0-alpha713.0.0-alpha813.0.0-alpha9 |
13.0.0-alpha11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-13274 is a medium vulnerability (CVSS 5.3) in Drupal Open Social, published September 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in goalgorilla/open_social 12.3.8.
References
Left out here: 386 versions. The JSON record has them.