{"id":"CVE-2024-13259","aliases":["DRUPAL-CONTRIB-2024-023","EUVD-2024-51473","GHSA-qffj-hqp2-qrxm"],"status":"published","title":"Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00498,"percentile":0.43143,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-201"],"published":"2024-05-29T16:52:42Z","modified":"2026-10-28T02:31:07Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/image_sizes","fixed_in":["3.0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/image_sizes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2"}]}]}],"products":[{"vendor":"drupal","product":"image sizes"},{"vendor":"image_sizes_project","product":"image_sizes"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2024-023","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13259","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qffj-hqp2-qrxm"},{"url":"https://git.drupalcode.org/project/image_sizes","tags":["web"]},{"url":"https://www.drupal.org/project/image_sizes","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13259.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-13259","title":"Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.","status":"published","published":"2025-01-09T19:11:25.339Z","modified":"2025-01-10T16:44:21.601Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T14:34:13.64024Z"}],"euvd":[{"id":"EUVD-2024-51473","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.","status":"published","published":"2025-01-09T19:11:25Z","modified":"2025-01-10T16:44:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:04:21.63355Z"}],"ghsa":[{"id":"GHSA-qffj-hqp2-qrxm","title":"Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows...","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.","status":"published","published":"2025-01-09T21:31:30Z","modified":"2025-01-10T18:32:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T14:59:27.888313Z"}],"nvd":[{"id":"CVE-2024-13259","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.","status":"published","published":"2025-01-09T19:15:19.997Z","modified":"2026-06-17T07:01:36.68Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T14:10:41.838321Z"}],"osv":[{"id":"CVE-2024-13259","title":"Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.","status":"published","published":"2025-01-09T19:11:25.339Z","modified":"2026-10-28T02:31:07.653950454Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DRUPAL-CONTRIB-2024-023","description":"This module enables you to create responsive image styles that depend on the parent element's width.\n\nThe module doesn't sufficiently check access to rendered images, resulting in access bypass vulnerabilities in specific scenarios.","status":"published","published":"2024-05-29T16:52:42Z","modified":"2026-09-10T03:45:45.444241173Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}