CVE-2024-13301

CVE-2024-13301: OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067

Vendor Drupal
Product OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client)
Weakness CWE-79 · XSS
Published January 9, 2025
Last update January 10, 2025
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client): from 3.0.0 before 3.44.0, from 4.0.0 before 4.0.19.

Key dates

02Disclosure timeline

January 9, 2025 CVE published
January 10, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-36176 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) CVE-2025-8367 Portabilis i-Educar funcionario_vinculo_lst.php cross site scripting CVE-2023-23981 WordPress Conversational Forms for ChatBot Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS) CVE-2025-23858 WordPress Custom Users Order Plugin <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-32285 WordPress Butcher theme < 2.54 - Cross Site Scripting (XSS) vulnerability