CVE-2013-4227

Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users via a security token that is not a string data type.

Score

CVSS 3.1 8.8 High

Status

Modified - secalert@redhat.com

Published

2020-02-18

Last modified

2024-08-06

Weaknesses

CWE-352

Affected products

• Persona (Mozilla)

References

• http://drupalcode.org/project/persona.git/commitdiff/fe0f9bb
• http://www.openwall.com/lists/oss-security/2013/08/10/1
• https://drupal.org/node/2058655
• https://drupal.org/node/2059599