Unscored severity · published Aug 21, 2013
CVE-2013-4230
The mm_webform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restrict access to webform submissions, which…
–
CVSS
1.2%
EPSS
No
On KEV
Description
The mm_webform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restrict access to webform submissions, which allows remote authenticated users with the "Who can read data submitted to this webform" permission to delete arbitrary submissions via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MM
Monster Menus · Monster Menus Project
6.x-6.19; 6.x-6.22; 6.x-6.23; 6.x-6.24; 6.x-6.25; 6.x-6.26; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4230
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4230
Vendor Advisory
http://secunia.com/advisories/54391
www.openwall.com
http://www.openwall.com/lists/oss-security/2013/08/10/1
www.securityfocus.com
http://www.securityfocus.com/bid/61711
Patch
https://drupal.org/node/2059805
Patch
https://drupal.org/node/2059807
Vendor Advisory
https://drupal.org/node/2059823
More from Monster Menus
9.1
CVE-2024-13281
Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045
6.1
CVE-2026-81201
Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116
4.3
CVE-2024-13288
Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052
–
CVE-2015-8095
The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive…
–
CVE-2013-4504
The Monster Menus module 7.x-1.x before 7.x-1.15 allows remote attackers to read arbitrary node comments via a crafted URL