Description

The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger application-specific impacts such as arbitrary code execution via application-specific vectors.

Remediation

References

CVE-2013-6385

Related Vulnerabilities

Nginx Other Vulnerability (CVE-2019-9513)

IBM RTC Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2019-4252)

OpenSSL Improper Input Validation Vulnerability (CVE-2015-0293)

Moodle CVE-2019-3852 Vulnerability (CVE-2019-3852)

WordPress Plugin LayerSlider Cross-Site Request Forgery (4.6.1)

Severity

Medium

Classification

CVE-2013-6385 CWE-94

Tags

Missing Update Known Vulnerabilities