{"id":"DRUPAL-CONTRIB-2024-028","aliases":["CVE-2024-13264"],"title":"DRUPAL-CONTRIB-2024-028","description":"The Opigno module is related to Opigno LMS distribution. It implements the module entity, that is a sub-part of a training.\n\nIn the opigno\\_module module, uploaded files were not sufficiently validated to prevent arbitrary file uploads, which could lead to Remote Code Execution (RCE) and/or Cross Site Scripting (XSS).\n\nThis vulnerability is mitigated by the fact that it requires the attacker have a role with the permission \"create opigno tincan activities\".","severity":"unknown","score":null,"published":"2024-08-07T17:30:20.000Z","modified":"2026-09-10T03:45:48.485Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/opigno_module","ranges":[{"events":[{"introduced":"0"},{"fixed":"3.1.2"}],"type":"ECOSYSTEM","database_specific":{"constraint":"<3.1.2"}}],"versions":[],"fixed":["3.1.2"]}],"references":["https://www.drupal.org/sa-contrib-2024-028"],"sources":[{"name":"OSV","id":"DRUPAL-CONTRIB-2024-028","modified":"2026-09-10T03:45:48.485730417Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2024-028"}],"assessments":[]}