CVE-2013-6385

The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation…

published December 7, 2013

CVSS
—
EPSS
3%
Percentile
87.6
In the wild
Unconfirmed
What it is

The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger application-specific impacts such as arbitrary code execution via application-specific vectors.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03072 · 87.6th percentile
Published
2013-12-07T21:00Z
EPSS history
Timeline
  • 07 DEC 21:00Z
    The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation…
    cvelistv5