CVE-2013-2158

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Cross-site request forgery (CSRF) vulnerability in the Services module 6.x-3.x and 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/93980
http://seclists.org/fulldisclosure/2013/Jun/23
http://secunia.com/advisories/53649Vendor Advisory
http://secunia.com/advisories/53661Vendor Advisory
http://www.securityfocus.com/bid/60356
https://drupal.org/node/2012366Vendor Advisory
https://drupal.org/node/2012982Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/84791
http://osvdb.org/93980
http://seclists.org/fulldisclosure/2013/Jun/23
http://secunia.com/advisories/53649Vendor Advisory
http://secunia.com/advisories/53661Vendor Advisory
http://www.securityfocus.com/bid/60356
https://drupal.org/node/2012366Vendor Advisory
https://drupal.org/node/2012982Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/84791

Timeline

Published: Jul 1, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-21599.8Monkey HTTP Daemon: broken user name authentication CVE-2013-21605.0The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a de CVE-2013-21617.5XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofe CVE-2013-21621.9Race condition in the post-installation script (mysql-server-5.5.postinst) for MySQL Server 5.5 for Debian GNU/Linux and Ubuntu Linux create CVE-2013-21635.0Monkey HTTP Daemon (monkeyd) before 1.2.2 allows remote attackers to cause a denial of service (infinite loop) via an offset equal to the fi CVE-2013-21642.1The mmc_ioctl_cdrom_read_data function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows local users to obtain sensitive info CVE-2013-21657.5ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web CVE-2013-21669.8python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass CVE-2013-21679.8python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass CVE-2013-21681.9The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1 CVE-2013-21716.9The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEASE-p4 does not proper CVE-2013-21724.3jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5