{"id":"CVE-2024-13250","aliases":["DRUPAL-CONTRIB-2024-014","EUVD-2024-51464","GHSA-5rcq-gp73-g9jv"],"status":"published","title":"Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00204,"percentile":0.10443,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2024-02-28T18:36:35Z","modified":"2026-10-28T02:31:03Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/symfony_mailer_lite","fixed_in":["1.0.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/symfony_mailer_lite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6"}]}]}],"products":[{"vendor":"drupal","product":"drupal symfony mailer lite"},{"vendor":"drupal_symfony_mailer_lite_project","product":"drupal_symfony_mailer_lite"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2024-014","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13250","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5rcq-gp73-g9jv"},{"url":"https://git.drupalcode.org/project/symfony_mailer_lite","tags":["web"]},{"url":"https://www.drupal.org/project/symfony_mailer_lite","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13250.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-13250","title":"Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.","status":"published","published":"2025-01-09T18:57:50.019Z","modified":"2025-01-10T17:09:26.669Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:34:13.321108Z"}],"euvd":[{"id":"EUVD-2024-51464","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.","status":"published","published":"2025-01-09T18:57:50Z","modified":"2025-01-10T17:09:26Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:21.63355Z"}],"ghsa":[{"id":"GHSA-5rcq-gp73-g9jv","title":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross...","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.","status":"published","published":"2025-01-09T21:31:30Z","modified":"2025-01-10T18:32:45Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:59:27.888313Z"}],"nvd":[{"id":"CVE-2024-13250","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.","status":"published","published":"2025-01-09T19:15:18.98Z","modified":"2026-06-17T07:01:35.203Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:10:41.838321Z"}],"osv":[{"id":"CVE-2024-13250","title":"Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.","status":"published","published":"2025-01-09T18:57:50.019Z","modified":"2026-10-28T02:31:03.30167668Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DRUPAL-CONTRIB-2024-014","description":"The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator into performing unwanted actions.\n\nThis vulnerability is mitigated by the fact that the set of unwanted actions is limited to specific configurations.","status":"published","published":"2024-02-28T18:36:35Z","modified":"2026-09-10T03:46:12.679124706Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}