Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-13274: Open Social may become unresponsive from repeated requests

CVE-2024-13274 · published 1 year ago

Summary

Versions of Open Social before 12.3.8 and between 12.4.0 and 12.4.4 can be overwhelmed by too‑many interactions, which may cause the site to stop responding. This can disrupt user activity and prevent normal operation. Upgrade to Open Social 12.3.8 or later, or to 12.4.5 or newer, to protect the system.

What to do

Update goalgorilla open_social to version 12.3.8.
Update goalgorilla open_social to version 12.4.5.
Update goalgorilla open_social to version 13.0.0-alpha11.
Update drupal drupal/social to version 13.0.0-alpha11.
Update goalgorilla goalgorilla/open_social to version 12.3.8.
Update goalgorilla goalgorilla/open_social to version 12.4.5.
Update goalgorilla goalgorilla/open_social to version 13.0.0-alpha11.

Affected software

Ecosystem	Vendor	Product	Affected versions
composer	goalgorilla	open_social	< 12.3.8 >= 12.4.0, < 12.4.5 >= 13.0.0-alpha1, < 13.0.0-alpha11 Fix: upgrade to 12.3.8
Packagist:https://packages.drupal.org/8	drupal	drupal/social	>= 13.0.0-alpha1, < 13.0.0-alpha11 Fix: upgrade to 13.0.0-alpha11
Packagist	goalgorilla	goalgorilla/open_social	< 12.3.8 >= 12.4.0, < 12.4.5 >= 13.0.0-alpha1, < 13.0.0-alpha11 Fix: upgrade to 12.3.8
–	getopensocial	open_social	< 12.3.8 >= 12.4.0, < 12.4.5 `cpe:2.3:a:getopensocial:open_social::::::drupal::*`

Original advisory text

Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038

Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.

References

https://github.com/advisories/GHSA-63wg-87qv-rw4r
https://www.drupal.org/sa-contrib-2024-038 URL
https://nvd.nist.gov/vuln/detail/CVE-2024-13274 Vendor Advisory
https://github.com/goalgorilla/open_social Product
https://git.drupalcode.org/project/social URL
https://www.drupal.org/project/social URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13274... Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

5.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-799Improper Control of Interaction Frequency

Timeline

Published9 Jan 2025

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-63wg-87qv-rw4r · GHSA

CVE-2024-13274 · NVD

DRUPAL-CONTRIB-2024-038 · OSV

GHSA-63wg-87qv-rw4r · OSV

CVE-2024-13274 · OSV

Track software like this

Free during beta