PT-2013-5020 · Drupal · Context

Published 2013-12-07 · Updated 2013-12-09 · CVE-2013-4446

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Context module versions 6.x-2.x through 6.x-3.1 Context module versions 7.x-3.x through 7.x-2.x

Description The issue allows remote attackers to execute arbitrary PHP code via unspecified vectors related to Ajax operations, possibly involving eval injection, when using a version of PHP that does not support the json decode function.

Recommendations For Context module versions 6.x-2.x through 6.x-3.1, update to version 6.x-3.2 or later. For Context module versions 7.x-3.x through 7.x-2.x, update to version 7.x-3.0 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2013-4446

Affected Products

Context

References · 9

• http://drupalcode.org/project/context.git/commitdiff/63ef4d9 · Patch
• http://drupalcode.org/project/context.git/commitdiff/d7b4afa · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122308.html · Vendor Advisory
• https://drupal.org/node/2112785 · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2013-November/121433.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122298.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4446 · Security Note
• https://drupal.org/node/2112791 · Patch
• https://drupal.org/node/2113317 · Vendor Advisory