{"id":"CVE-2024-13304","aliases":["DRUPAL-CONTRIB-2024-070","EUVD-2024-51517","GHSA-6hq6-3pp3-9598"],"status":"published","title":"Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.","severity":{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00178,"percentile":0.07483,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2024-12-04T15:51:12Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/minifyjs","fixed_in":["3.0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/minifyjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3"}]}]}],"products":[{"vendor":"drupal","product":"minify js"},{"vendor":"matthiasmullie","product":"minify_js"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2024-070","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13304","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6hq6-3pp3-9598"},{"url":"https://git.drupalcode.org/project/minifyjs","tags":["web"]},{"url":"https://www.drupal.org/project/minifyjs","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13304.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-13304","title":"Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.","status":"published","published":"2025-01-09T20:25:04.098Z","modified":"2025-01-10T17:53:34.294Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:34:13.321108Z"}],"euvd":[{"id":"EUVD-2024-51517","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.","status":"published","published":"2025-01-09T20:25:04Z","modified":"2025-01-10T17:53:34Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:21.63355Z"}],"ghsa":[{"id":"GHSA-6hq6-3pp3-9598","title":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request...","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.","status":"published","published":"2025-01-09T21:31:32Z","modified":"2025-01-10T18:32:46Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:59:27.888313Z"}],"nvd":[{"id":"CVE-2024-13304","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.","status":"published","published":"2025-01-09T21:15:28.387Z","modified":"2026-06-17T07:01:44.23Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:10:42.329342Z"}],"osv":[{"id":"CVE-2024-13304","title":"Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070","description":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.","status":"published","published":"2025-01-09T20:25:04.098Z","modified":"2026-10-28T02:31:13.160634605Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DRUPAL-CONTRIB-2024-070","description":"The Minify JS module allows a site administrator to minify all javascript files that exist in the site's code base and use those minified files on the front end of the website.\n\nSeveral administrator routes are unprotected against Cross-Site Request Forgery (CRSF) attacks.","status":"published","published":"2024-12-04T15:51:12Z","modified":"2026-09-10T03:46:09.753517148Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}