Description

Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to generate random numbers, which uses predictable seeds and allows remote attackers to predict security strings and bypass intended restrictions via a brute force attack.

Remediation

References

CVE-2013-6386

Related Vulnerabilities

WordPress Plugin WP-CopyProtect [Protect your blog posts] Cross-Site Scripting (3.0.0)

WordPress Plugin WP Inimat Cross-Site Scripting (1.0)

ownCloud Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-9046)

Liferay DXP Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2022-42121)

WordPress Plugin SyntaxHighlighter Evolved Cross-Site Scripting (3.1.5)

Severity

Medium

Classification

CVE-2013-6386

Tags

Missing Update Known Vulnerabilities