CVE-2024-13308

mediumpriority · track · 0EPSS 0.003 · 18 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.26% (18th) EPSS

CVSS 4.8 · medium

Is it mine?

17 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2.

cvss

Technical severity, 0–10. One row per scoring source.

4.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.5–4.8

v3.14.8mediumAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.13.8lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:Nsecondary · ENISA EU

v3.13.8lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:Nsecondaryexploitability 1.2 · impact 2.5

v3.13.5lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79US

affected products (17)

Products and version ranges known to be affected.

Open Source Drupal Allow All File Extensionsall versionscert_bundDE
Open Source Drupal Browser Back Button <2.0.2all versionscert_bundDE
Open Source Drupal Git Utilitiesall versionscert_bundDEcpe:/a:drupal:drupal:git_utilities
Open Source Drupal Login Disable <2.1.1all versionscert_bundDE
Open Source Drupal Open Social <12.3.10all versionscert_bundDE
Open Source Drupal Open Social <12.4.9all versionscert_bundDE
Open Source Drupal≤ Login Disable <2.1.1cert_bundDE
Open Source Drupal≤ Allow All File Extensionscert_bundDE
Open Source Drupal≤ Browser Back Button <2.0.2cert_bundDE
Open Source Drupal≤ Open Social <12.3.10cert_bundDE
Open Source Drupal≤ Open Social <12.4.9cert_bundDE
Drupal Browser Back Button1.0.0 → 2.0.2enisa_euvdEU
Сообщество свободного программного обеспечения Browser Back Button1.0.0 → 2.0.2.fstec_bduRU
browser back button project browser back button2.0.0 → 2.0.2nvdUScpe:2.3:a:browser_back_button_project:browser_back_button:*:*:*:*:*:*:*:*
browser back button project browser back button= 8.x-1.0nvdUScpe:2.3:a:browser_back_button_project:browser_back_button:*:*:*:*:*:*:*:*
browser back button project browser back button= 8.x-1.1nvdUScpe:2.3:a:browser_back_button_project:browser_back_button:*:*:*:*:*:*:*:*
Packagist:https://packages.drupal.org/8 drupal/browser_back_button1.0.0 → 2.0.2osvUSpkg:composer/drupal/browser_back_button?repository_url=https:%2F%2Fpackages.drupal.org%2F8

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-3686Drupal: Mehrere Schwachstellen ermöglichenDeutsch2024-12-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen oder einen unspezifischen Angriff auszuführen.
DRUPAL-CONTRIB-2024-0722024-12-11vendor · osvUS
This module provides a block that renders a link providing the functionality of a browser's back button. The module does not sufficiently escape text entered by an administrator, resulting in a cross scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks".

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd osv NVD CVE.org MITRE

published 2025-01-09modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan