ByteOS Network

Vulnerability Details :

CVE-2013-4504

Assigner-redhat

Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749

Published At-13 May, 2014 | 15:00

Updated At-06 Aug, 2024 | 16:45

The Monster Menus module 7.x-1.x before 7.x-1.15 allows remote attackers to read arbitrary node comments via a crafted URL.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:redhat

Assigner Org ID:53f830b8-0a3f-465b-8143-3b8a9948e749

Published At:13 May, 2014 | 15:00

Updated At:06 Aug, 2024 | 16:45

▼CVE Numbering Authority (CNA)

The Monster Menus module 7.x-1.x before 7.x-1.15 allows remote attackers to read arbitrary node comments via a crafted URL.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://drupal.org/node/2123287	x_refsource_CONFIRM
https://drupal.org/node/2124289	x_refsource_MISC
http://seclists.org/oss-sec/2013/q4/210	mailing-list x_refsource_MLIST

Hyperlink: https://drupal.org/node/2123287

Resource:

x_refsource_CONFIRM

Hyperlink: https://drupal.org/node/2124289

Resource:

x_refsource_MISC

Hyperlink: http://seclists.org/oss-sec/2013/q4/210

Resource:

mailing-list

x_refsource_MLIST

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://drupal.org/node/2123287	x_refsource_CONFIRM x_transferred
https://drupal.org/node/2124289	x_refsource_MISC x_transferred
http://seclists.org/oss-sec/2013/q4/210	mailing-list x_refsource_MLIST x_transferred

Hyperlink: https://drupal.org/node/2123287

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://drupal.org/node/2124289

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://seclists.org/oss-sec/2013/q4/210

Resource:

mailing-list

x_refsource_MLIST

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert@redhat.com

Published At:13 May, 2014 | 15:55

Updated At:27 Aug, 2025 | 15:51

The Monster Menus module 7.x-1.x before 7.x-1.15 allows remote attackers to read arbitrary node comments via a crafted URL.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	2.6	LOW	AV:N/AC:H/Au:N/C:P/I:N/A:N

Type: Primary

Version: 2.0

Base score: 2.6

Base severity: LOW

Vector:

AV:N/AC:H/Au:N/C:P/I:N/A:N

CPE Matches

monster_menus_project>>monster_menus>>7.x-1.0

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.0:*:*:*:*:*:*:*

monster_menus_project>>monster_menus>>7.x-1.1

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.1:*:*:*:*:*:*:*

monster_menus_project>>monster_menus>>7.x-1.2

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.2:*:*:*:*:*:*:*

monster_menus_project>>monster_menus>>7.x-1.3

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.3:*:*:*:*:*:*:*

monster_menus_project>>monster_menus>>7.x-1.4

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.4:*:*:*:*:*:*:*

monster_menus_project>>monster_menus>>7.x-1.5

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.5:*:*:*:*:*:*:*

monster_menus_project>>monster_menus>>7.x-1.6

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.6:*:*:*:*:*:*:*

monster_menus_project>>monster_menus>>7.x-1.7

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.7:*:*:*:*:*:*:*

monster_menus_project>>monster_menus>>7.x-1.8

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.8:*:*:*:*:*:*:*

monster_menus_project>>monster_menus>>7.x-1.9

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.9:*:*:*:*:*:*:*

monster_menus_project>>monster_menus>>7.x-1.10

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.10:*:*:*:*:*:*:*

monster_menus_project>>monster_menus>>7.x-1.11

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.11:*:*:*:*:*:*:*

monster_menus_project>>monster_menus>>7.x-1.12

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.12:*:*:*:*:*:*:*

monster_menus_project>>monster_menus>>7.x-1.13

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.13:*:*:*:*:*:*:*

monster_menus_project>>monster_menus>>7.x-1.14

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.14:*:*:*:*:*:*:*

monster_menus_project>>monster_menus>>7.x-1.x

cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.x:dev:*:*:*:*:*:*

The Drupal Association

>>drupal>>-

cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-264	Primary	nvd@nist.gov

CWE ID: CWE-264

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://seclists.org/oss-sec/2013/q4/210	secalert@redhat.com	N/A
https://drupal.org/node/2123287	secalert@redhat.com	Patch
https://drupal.org/node/2124289	secalert@redhat.com	Patch Vendor Advisory
http://seclists.org/oss-sec/2013/q4/210	af854a3a-2127-422b-91ae-364da2661108	N/A
https://drupal.org/node/2123287	af854a3a-2127-422b-91ae-364da2661108	Patch
https://drupal.org/node/2124289	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory

Hyperlink: http://seclists.org/oss-sec/2013/q4/210

Source: secalert@redhat.com

Resource: N/A

Hyperlink: https://drupal.org/node/2123287

Source: secalert@redhat.com

Resource:

Patch

Hyperlink: https://drupal.org/node/2124289

Source: secalert@redhat.com

Resource:

Patch

Vendor Advisory

Hyperlink: http://seclists.org/oss-sec/2013/q4/210

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://drupal.org/node/2123287

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Hyperlink: https://drupal.org/node/2124289

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Vendor Advisory

Similar CVEs

3Records found

CVE-2012-2731

Matching Score-8

Assigner-Red Hat, Inc.

View Details

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-2.6||LOW

EPSS-0.56% / 67.26%

7 Day CHG~0.00%

Published-27 Jun, 2012 | 00:00

Updated-11 Apr, 2025 | 00:51

The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which might allow remote attackers to obtain sensitive information by sniffing or reading the cache of the HTML of a webpage.

Vendor-richardo_ante n/a The Drupal Association

Product-drupal ubercart_ajax_cart n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2012-1645

Matching Score-8

Assigner-Red Hat, Inc.

View Details

Matching Score-8

Assigner-Red Hat, Inc.

CVSS Score-2.6||LOW

EPSS-0.59% / 68.27%

7 Day CHG~0.00%

Published-28 Aug, 2012 | 16:00

Updated-11 Apr, 2025 | 00:51

The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php.

Vendor-wimleers n/a The Drupal Association

Product-cdn drupal n/a

CWE ID-CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2006-5477

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-2.6||LOW

EPSS-0.66% / 70.14%

7 Day CHG~0.00%

Published-24 Oct, 2006 | 20:00

Updated-07 Aug, 2024 | 19:48

Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allows form submissions to be redirected, which allows remote attackers to obtain arbitrary form information via a crafted URL.

Vendor-n/a The Drupal Association

Product-drupal n/a

CVE-2013-4504

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs