PT-2013-5020

CVE-2013-4446

·

Published

2013-12-07

·

Updated

2013-12-09

Description by

CVSS 2.0
6.8
Medium
MetricsAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Context module versions 6.x-2.x through 6.x-3.1 Context module versions 7.x-3.x through 7.x-2.x
Description The issue allows remote attackers to execute arbitrary PHP code via unspecified vectors related to Ajax operations, possibly involving eval injection, when using a version of PHP that does not support the json decode function.
Recommendations For Context module versions 6.x-2.x through 6.x-3.1, update to version 6.x-3.2 or later. For Context module versions 7.x-3.x through 7.x-2.x, update to version 7.x-3.0 or later.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-94: Improper Control of Generation of Code (\'Code Injection\')
Related identifiers
CVE-2013-4446
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com