CVE-2013-4230

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-08-21 · updated 2026-06-16
Weakness: CWE-264

Description

The mm_webform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restrict access to webform submissions, which allows remote authenticated users with the "Who can read data submitted to this webform" permission to delete arbitrary submissions via unspecified vectors.

Affected products

Drupal Monster Menus: 6.x-6.19, 6.x-6.22, 6.x-6.23, 6.x-6.24, 6.x-6.25, 6.x-6.26 (+35)

References

http://secunia.com/advisories/54391
http://www.openwall.com/lists/oss-security/2013/08/10/1
http://www.securityfocus.com/bid/61711
https://drupal.org/node/2059805
https://drupal.org/node/2059807
https://drupal.org/node/2059823
https://exchange.xforce.ibmcloud.com/vulnerabilities/86326
http://secunia.com/advisories/54391
http://www.openwall.com/lists/oss-security/2013/08/10/1
http://www.securityfocus.com/bid/61711
https://drupal.org/node/2059805
https://drupal.org/node/2059807

Get alerted when CVE-2013-4230 or the next vulnerability affects your stack