{"id":"CVE-2024-13269","aliases":["DRUPAL-CONTRIB-2024-033","EUVD-2024-51483","GHSA-p27g-6xm5-rqrf"],"status":"published","title":"Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00376,"percentile":0.31904,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-201"],"published":"2024-08-28T15:32:41Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/adv_varnish","fixed_in":["4.0.11"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/adv_varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.11"}]}]}],"products":[{"vendor":"advanced_varnish_project","product":"advanced_varnish"},{"vendor":"drupal","product":"advanced varnish"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2024-033","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13269","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p27g-6xm5-rqrf"},{"url":"https://git.drupalcode.org/project/adv_varnish","tags":["web"]},{"url":"https://www.drupal.org/project/adv_varnish","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13269.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-13269","title":"Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.","status":"published","published":"2025-01-09T19:18:49.539Z","modified":"2025-01-30T21:44:20.849Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T14:34:13.321108Z"}],"euvd":[{"id":"EUVD-2024-51483","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.","status":"published","published":"2025-01-09T19:18:49Z","modified":"2025-01-30T21:44:20Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:08.578338Z"}],"ghsa":[{"id":"GHSA-p27g-6xm5-rqrf","title":"Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows...","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.","status":"published","published":"2025-01-09T21:31:31Z","modified":"2025-01-31T00:31:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T14:59:43.882222Z"}],"nvd":[{"id":"CVE-2024-13269","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.","status":"published","published":"2025-01-09T20:15:35.687Z","modified":"2026-06-17T07:01:38.41Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T14:10:41.838321Z"}],"osv":[{"id":"CVE-2024-13269","title":"Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.","status":"published","published":"2025-01-09T19:18:49.539Z","modified":"2026-10-28T02:30:50.939841748Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DRUPAL-CONTRIB-2024-033","description":"This module enables you to cache pages for logged in users at the Varnish level.\n\nThe Varnish bin names may be guessable when no hashing noise configuration is set on the module configuration page, which would ultimately allow any user to view cached pages that were intended for other roles when guessing such a bin name.","status":"published","published":"2024-08-28T15:32:41Z","modified":"2026-09-10T03:45:04.715950015Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}