CVE-2013-4446

Context module for Drupal 6.x-2.x-6.x-3.2 and 7.x-3.x-7.x-3.0 - Remote Code Execution via _json_decode Function

Title source: llm
STIX 2.1

Description

The _json_decode function in plugins/context_reaction_block.inc in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal, when using a version of PHP that does not support the json_decode function, allows remote attackers to execute arbitrary PHP code via unspecified vectors related to Ajax operations, possibly involving eval injection.

References (8)

Core 8
Core References
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122308.html
Patch, Vendor Advisory x_refsource_confirm
https://drupal.org/node/2113317
Patch x_refsource_confirm
https://drupal.org/node/2112785
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2013-November/121433.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122298.html
Patch x_refsource_confirm
https://drupal.org/node/2112791

Scores

EPSS 0.0153
EPSS Percentile 71.6%

Details

CWE
CWE-94
Status published
Products (6)
steven_jones/context 6.x-2.0 alpha1 (12 CPE variants)
steven_jones/context 6.x-3.0 (13 CPE variants)
steven_jones/context 6.x-3.1
steven_jones/context 6.x-3.x dev
steven_jones/context 7.x-3.0 alpha1 (10 CPE variants)
steven_jones/context 7.x-3.x dev
Published Dec 07, 2013
Tracked Since Feb 18, 2026