DRUPAL-CONTRIB-2024-024

Import Source

https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/migrate_queue_importer/DRUPAL-CONTRIB-2024-024.json

JSON Data

https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2024-024

Aliases

CVE-2024-13260

Published

2024-05-29T16:58:59Z

Modified

2025-12-10T23:41:28.868143Z

Summary

[none]

Details

The Migrate queue importer module enables you to create cron migrations(configuration entities) with a reference towards migration entities in order to import them during cron runs.

The module doesn't sufficiently protect against Cross Site Request Forgery
under specific scenarios allowing an attacker to enable/disable a cron migration.

This vulnerability is mitigated by the fact that an attacker must know the
id of the migration.

References

https://www.drupal.org/sa-contrib-2024-024

Credits

- Pierre Rudloff
- - https://www.drupal.org/user/3611858

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/migrate_queue_importer

Package

Name: drupal/migrate_queue_importer
Purl: pkg:composer/drupal/migrate_queue_importer

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

2.1.1

Database specific

{
    "constraint": "<2.1.1"
}

Database specific

affected_versions

"<2.1.1"

source

"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/migrate_queue_importer/DRUPAL-CONTRIB-2024-024.json"