PT-2020-7486 · Mozilla · Persona

Forest Monsen · Published 2020-02-18 · Updated 2020-02-27 · CVE-2013-4227

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Mozilla Persona module versions 7.x-1.x through 7.x-1.10

Description: A cross-site request forgery (CSRF) issue exists in the persona xsrf token function within the persona.module of the Mozilla Persona module for Drupal. This allows remote attackers to hijack the authentication of arbitrary users via a security token that is not a string data type.

Recommendations: For Mozilla Persona module versions 7.x-1.x through 7.x-1.10, update to version 7.x-1.11 or later to resolve the issue. As a temporary workaround, consider disabling the persona xsrf token function until a patch is available. Restrict access to the persona.module to minimize the risk of exploitation. Avoid using the security token in a non-string data type in the affected module until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2013-4227

Affected Products

Persona

References · 6

• https://drupal.org/node/2058655 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-4227 · Security Note
• http://drupalcode.org/project/persona.git/commitdiff/fe0f9bb · Patch
• http://openwall.com/lists/oss-security/2013/08/10/1 · Note
• https://drupal.org/node/2059599 · Note
• https://t.me/cibsecurity/9895 · Telegram Post