PT-2013-5020 · Drupal · Context

Publicado 2013-12-07 · Atualizado 2013-12-09 · CVE-2013-4446

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Context module versions 6.x-2.x through 6.x-3.1 Context module versions 7.x-3.x through 7.x-2.x

Description The issue allows remote attackers to execute arbitrary PHP code via unspecified vectors related to Ajax operations, possibly involving eval injection, when using a version of PHP that does not support the json decode function.

Recommendations For Context module versions 6.x-2.x through 6.x-3.1, update to version 6.x-3.2 or later. For Context module versions 7.x-3.x through 7.x-2.x, update to version 7.x-3.0 or later.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2013-4446

Produtos afetados

Context

Referências · 9

• http://drupalcode.org/project/context.git/commitdiff/63ef4d9 · Correção
• http://drupalcode.org/project/context.git/commitdiff/d7b4afa · Correção
• http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122308.html · Aviso do Fabricante
• https://drupal.org/node/2112785 · Correção
• http://lists.fedoraproject.org/pipermail/package-announce/2013-November/121433.html · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122298.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-4446 · Nota de Segurança
• https://drupal.org/node/2112791 · Correção
• https://drupal.org/node/2113317 · Aviso do Fabricante