5.1
CVE-2013-6385
- EPSS 3.07%
- Veröffentlicht 07.12.2013 21:55:10
- Zuletzt bearbeitet 29.04.2026 01:13:23
- Erkennungen
LoginThe form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger application-specific impacts such as arbitrary code execution via application-specific vectors.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 3.07% | 0.859 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 5.1 | 4.9 | 6.4 |
AV:N/AC:H/Au:N/C:P/I:P/A:P
|
CWE-94 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
http://secunia.com/advisories/56148
http://www.debian.org/security/2013/dsa-2804
http://www.debian.org/security/2013/dsa-2828
http://www.openwall.com/lists/oss-security/2013/11/22/4
https://drupal.org/SA-CORE-2013-003