VULNERABILITY INTELLIGENCE

CVE-2013-4446

CVSS score6.8 MEDIUM
EPSS probability1.53%
CISA KEVNot currently listed
Published2013-12-07
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P

Description

The _json_decode function in plugins/context_reaction_block.inc in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal, when using a version of PHP that does not support the json_decode function, allows remote attackers to execute arbitrary PHP code via unspecified vectors related to Ajax operations, possibly involving eval injection.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references