# CVE-2024-13284: DRUPAL-CONTRIB-2024-048 - This module provides a new UI experience for node editing using the Gutenberg Editor…

Source: https://junglewise.ai/threats/cve-2024-13284-drupal-contrib-2024-048-this-module-provides-a-new-ui-experience  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-10-09  
License: CC BY 4.0 with a link back

CVE-2024-13284 · Severity: info · Published 2024-10-09

This module provides a new UI experience for node editing using the Gutenberg Editor library.

The module did not sufficiently protect some routes against a Cross Site Request Forgery attack.

This vulnerability is mitigated by the fact that the tricked user needs to have an active session with the "use gutenberg" permission.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Gutenberg](https://junglewise.ai/threats/technologies/drupal-gutenberg). Vendors: [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is CVE-2024-13284 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-13284 being exploited in the wild.

**How severe is CVE-2024-13284?** Informational severity, published 9 October 2024.

**Which products and versions are affected?** Packagist:Https://Packages.Drupal.Org/8 Drupal/Gutenberg ECOSYSTEM:introduced=0,fixed=2.13.0|ECOSYSTEM:introduced=3.0.0,fixed=3.0.5.

**Is there a fix for CVE-2024-13284?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Gutenberg: upgrade to 2.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2024-13284?** Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Gutenberg at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Gutenberg: upgrade to 2.13.0 or later

## Affected products

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Gutenberg ECOSYSTEM:introduced=0,fixed=2.13.0|ECOSYSTEM:introduced=3.0.0,fixed=3.0.5

## Identifiers

- CVE-2024-13284
- DRUPAL-CONTRIB-2024-048

## Related threats

- [Drupal Gutenberg module insufficient entity access checks](https://junglewise.ai/threats/cve-2026-107263-drupal-contrib-2026-202-this-module-provides-a-new-ui-experience)
- [DRUPAL-CONTRIB-2023-009 - This module provides a new UI experience for node editing - Gutenberg editor. This…](https://junglewise.ai/threats/drupal-contrib-2023-009-this-module-provides-a-new-ui-experience-for-c4584a16)
- [DRUPAL-CONTRIB-2021-007 - This module provides a new UI experience for node editing using the Gutenberg Editor…](https://junglewise.ai/threats/drupal-contrib-2021-007-this-module-provides-a-new-ui-experience-for-f52f7b92)
- [DRUPAL-CONTRIB-2019-069 - This module provides a new UI experience for node editing - Gutenberg editor. The routes…](https://junglewise.ai/threats/drupal-contrib-2019-069-this-module-provides-a-new-ui-experience-for-b3b717fa)