{"id":"CVE-2024-13243","aliases":["DRUPAL-CONTRIB-2024-007","EUVD-2024-51457","GHSA-m53w-jm38-mh7q"],"status":"published","title":"Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007","description":"Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00279,"percentile":0.20552,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2024-01-31T17:22:36Z","modified":"2026-10-28T02:30:31Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/entity_delete_log","fixed_in":["1.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/entity_delete_log","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]}],"products":[{"vendor":"drupal","product":"entity delete log"},{"vendor":"entity_delete_log_project","product":"entity_delete_log"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2024-007","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13243","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m53w-jm38-mh7q"},{"url":"https://git.drupalcode.org/project/entity_delete_log","tags":["web"]},{"url":"https://www.drupal.org/project/entity_delete_log","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13243.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-13243","title":"Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007","description":"Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1.","status":"published","published":"2025-01-09T18:49:49.688Z","modified":"2025-01-10T17:11:34.905Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:34:13.64024Z"}],"euvd":[{"id":"EUVD-2024-51457","description":"Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1.","status":"published","published":"2025-01-09T18:49:49Z","modified":"2025-01-10T17:11:34Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:21.63355Z"}],"ghsa":[{"id":"GHSA-m53w-jm38-mh7q","title":"Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This...","description":"Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1.","status":"published","published":"2025-01-09T21:31:30Z","modified":"2025-01-10T18:32:45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:59:27.888313Z"}],"nvd":[{"id":"CVE-2024-13243","description":"Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1.","status":"published","published":"2025-01-09T19:15:18.14Z","modified":"2026-06-17T07:01:34.057Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:10:41.838321Z"}],"osv":[{"id":"CVE-2024-13243","title":"Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007","description":"Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1.","status":"published","published":"2025-01-09T18:49:49.688Z","modified":"2026-10-28T02:30:31.717065851Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DRUPAL-CONTRIB-2024-007","description":"The Entity Delete Log module tracks the deletion of configured entity types, such as node or comments.\n\nIt does not add sufficient permission to the log report page, allowing an attacker to view information from deleted entities.","status":"published","published":"2024-01-31T17:22:36Z","modified":"2026-09-10T03:45:47.55187646Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}