CVE-2013-4446: Code Injection
The jsondecode function in plugins/contextreactionblock.inc in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal, when using a version of PHP that does not support the jsondecode function, allows remote attackers to execute arbitrary PHP code via unspecified vectors related to Ajax operations, possibly involving eval injection.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4446?
The severity of CVE-2013-4446 is considered critical due to the potential for remote code execution.
How can I fix CVE-2013-4446?
To fix CVE-2013-4446, upgrade to Context module version 6.x-3.2 or 7.x-3.0 and later.
Which versions of the Context module are affected by CVE-2013-4446?
CVE-2013-4446 affects Context module versions 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0.
What exploitation methods are used with CVE-2013-4446?
Exploitation of CVE-2013-4446 can occur through unspecified vectors that allow unauthorized remote PHP code execution.
Are there any known attacks leveraging CVE-2013-4446?
Yes, there are known reports of attacks utilizing CVE-2013-4446 for unauthorized access and remote control of affected systems.