Back to CVE Browser

CVE-2013-4227

HIGH

8.8

CVSS Severity Score

EPSS Score0.0640%

EPSS Percentile8.07th

PublishedFeb 18, 2020

Last ModifiedNov 21, 2024

Vulnerability Description

Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users via a security token that is not a string data type.

Affected Platforms (CPE)

📦

Mozilla

Persona

>= 7.x-1.0 and < 7.x-1.11

References & Advisories

🔗 http://drupalcode.org/project/persona.git/commitdiff/fe0f9bb

🔗 http://www.openwall.com/lists/oss-security/2013/08/10/1

🔗 https://drupal.org/node/2058655

🔗 https://drupal.org/node/2059599

🔗 http://drupalcode.org/project/persona.git/commitdiff/fe0f9bb

🔗 http://www.openwall.com/lists/oss-security/2013/08/10/1

🔗 https://drupal.org/node/2058655

🔗 https://drupal.org/node/2059599

Related Vulnerabilities

CVE-2012-27149.8

The BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of a...

CVE-2020-250559.8

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The persona service allows attackers ...

CVE-2021-15947.5

A vulnerability in the REST API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform...

CVE-2017-186697.5

An issue was discovered on Samsung mobile devices with N(7.x) software. Persona has an unprotected API that allows launch of any a...