CVE-2013-6386: Medium severity Drupal Drupal vulnerability
Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mtrand function to generate random numbers, which uses predictable seeds and allows remote attackers to predict security strings and bypass intended restrictions via a brute force attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupalto a version that resolves this vulnerability.Fixed in 6.29 - Upgrade
Upgrade
drupalto a version that resolves this vulnerability.Fixed in 7.24
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6386?
CVE-2013-6386 has a moderate severity rating due to its potential for remote attackers to predict security strings.
How do I fix CVE-2013-6386?
To fix CVE-2013-6386, update Drupal to version 6.29 or 7.24 or later.
What versions of Drupal are affected by CVE-2013-6386?
CVE-2013-6386 affects Drupal versions 6.x before 6.29 and 7.x before 7.24.
What could an attacker gain by exploiting CVE-2013-6386?
An attacker exploiting CVE-2013-6386 could potentially bypass intended restrictions using brute force techniques.
Is there a workaround for CVE-2013-6386?
There is no official workaround for CVE-2013-6386 other than upgrading to the patched versions of Drupal.