CVE-2013-2158 : Cross-site request forgery (CSRF) vulnerability in the Services module 6.x-3.x a

Cross-site request forgery (CSRF) vulnerability in the Services module 6.x-3.x and 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

Published 2013-07-01 21:55:02

Updated 2017-08-29 01:33:15

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Cross-site request forgery (CSRF)

Products affected by CVE-2013-2158

Services Project » Services » Version: 7.x-3.1
cpe:2.3:a:services_project:services:7.x-3.1:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Services Project » Services » Version: 7.x-3.2
cpe:2.3:a:services_project:services:7.x-3.2:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Services Project » Services » Version: 6.x-3.1
cpe:2.3:a:services_project:services:6.x-3.1:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Services Project » Services » Version: 6.x-3.2
cpe:2.3:a:services_project:services:6.x-3.2:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Services Project » Services » Version: 6.x-3.3
cpe:2.3:a:services_project:services:6.x-3.3:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Services Project » Services » Version: 7.x-3.0
cpe:2.3:a:services_project:services:7.x-3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Services Project » Services » Version: 7.x-3.3
cpe:2.3:a:services_project:services:7.x-3.3:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A
Services Project » Services » Version: 6.x-3.0
cpe:2.3:a:services_project:services:6.x-3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2013-2158

EPSS FAQ

0.35%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 68 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2013-2158

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2013-2158

CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-2158

http://seclists.org/fulldisclosure/2013/Jun/23

Full Disclosure: [Security-news] SA-CONTRIB-2013-051 - Services - Cross site request forgery (CSRF)
https://exchange.xforce.ibmcloud.com/vulnerabilities/84791

Services module for Drupal unspecified cross-site request forgery CVE-2013-2158 Vulnerability Report
https://drupal.org/node/2012982

SA-CONTRIB-2013-051 - Services - Cross site request forgery (CSRF) | Drupal.org
Vendor Advisory
http://www.securityfocus.com/bid/60356

Drupal Services Module Cross Site Request Forgery Vulnerability
https://drupal.org/node/2012366

services 7.x-3.4 | Drupal.org
Vendor Advisory

Jump to

Vulnerability Details : CVE-2013-2158

Products affected by CVE-2013-2158

Exploit prediction scoring system (EPSS) score for CVE-2013-2158

CVSS scores for CVE-2013-2158

CWE ids for CVE-2013-2158

References for CVE-2013-2158