Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2013-4446
HistoryDec 07, 2013 - 8:55 p.m.

CVE-2013-4446

2013-12-0720:55:02
CWE-94
[email protected]
web.nvd.nist.gov
20
cve-2013-4446
drupal
context module
remote code execution
nvd
php
json_decode
ajax operations
eval injection

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

AI Score

Confidence

Low

0.013 Low

EPSS

Percentile

85.6%

JSON

The _json_decode function in plugins/context_reaction_block.inc in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal, when using a version of PHP that does not support the json_decode function, allows remote attackers to execute arbitrary PHP code via unspecified vectors related to Ajax operations, possibly involving eval injection.

Affected configurations

NVD
Node
steven_jonescontextMatch6.x-2.0alpha1
OR
steven_jonescontextMatch6.x-2.0alpha2
OR
steven_jonescontextMatch6.x-2.0beta1
OR
steven_jonescontextMatch6.x-2.0beta2
OR
steven_jonescontextMatch6.x-2.0beta3
OR
steven_jonescontextMatch6.x-2.0beta4
OR
steven_jonescontextMatch6.x-2.0beta5
OR
steven_jonescontextMatch6.x-2.0beta6
OR
steven_jonescontextMatch6.x-2.0beta7
OR
steven_jonescontextMatch6.x-2.0rc1
OR
steven_jonescontextMatch6.x-2.0rc2
OR
steven_jonescontextMatch6.x-2.0rc3
OR
steven_jonescontextMatch6.x-3.0
OR
steven_jonescontextMatch6.x-3.0alpha1
OR
steven_jonescontextMatch6.x-3.0alpha2
OR
steven_jonescontextMatch6.x-3.0beta1
OR
steven_jonescontextMatch6.x-3.0beta2
OR
steven_jonescontextMatch6.x-3.0beta3
OR
steven_jonescontextMatch6.x-3.0beta4
OR
steven_jonescontextMatch6.x-3.0beta5
OR
steven_jonescontextMatch6.x-3.0beta6
OR
steven_jonescontextMatch6.x-3.0beta7
OR
steven_jonescontextMatch6.x-3.0beta8
OR
steven_jonescontextMatch6.x-3.0rc1
OR
steven_jonescontextMatch6.x-3.0rc2
OR
steven_jonescontextMatch6.x-3.1
OR
steven_jonescontextMatch6.x-3.xdev
OR
steven_jonescontextMatch7.x-3.0alpha1
OR
steven_jonescontextMatch7.x-3.0alpha2
OR
steven_jonescontextMatch7.x-3.0alpha3
OR
steven_jonescontextMatch7.x-3.0beta1
OR
steven_jonescontextMatch7.x-3.0beta2
OR
steven_jonescontextMatch7.x-3.0beta3
OR
steven_jonescontextMatch7.x-3.0beta4
OR
steven_jonescontextMatch7.x-3.0beta5
OR
steven_jonescontextMatch7.x-3.0beta6
OR
steven_jonescontextMatch7.x-3.0beta7
OR
steven_jonescontextMatch7.x-3.xdev
AND
drupaldrupalMatch-

Related

cvelist 1
prion 1
nvd 1
nessus 6
openvas 8
fedora 6
cvelist
cvelist
CVE-2013-4446
2013-12-07 20:00:00
prion
prion
Design/Logic Flaw
2013-12-07 20:55:00
nvd
nvd
CVE-2013-4446
2013-12-07 20:55:02
nessus
nessus
Fedora 19 : drupal7-context-3.1-1.fc19 (2013-20965)
2013-11-21 00:00:00
Fedora 20 : drupal6-context-3.3-1.fc20 (2013-21303)
2013-11-25 00:00:00
Fedora 18 : drupal6-context-3.3-1.fc18 (2013-21298)
2013-11-25 00:00:00
openvas
openvas
Fedora Update for drupal7-context FEDORA-2013-20965
2013-11-21 00:00:00
Fedora Update for drupal6-context FEDORA-2013-21231
2013-11-26 00:00:00
Fedora Update for drupal7-context FEDORA-2013-20965
2013-11-21 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: drupal6-context-3.3-1.fc20
2013-11-24 03:32:46
[SECURITY] Fedora 19 Update: drupal6-context-3.3-1.fc19
2013-11-23 19:52:08
[SECURITY] Fedora 20 Update: drupal7-context-3.1-1.fc20
2013-11-13 02:01:27

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

AI Score

Confidence

Low

0.013 Low

EPSS

Percentile

85.6%

JSON
Related for CVE-2013-4446
cvelist1prion1nvd1nessus6openvas8fedora6