Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

BrowserID module lets attackers hijack user logins

CVE-2012-2713 · published 14 years ago
Summary

The BrowserID (Mozilla Persona) add‑on for Drupal versions earlier than 7.x‑1.3 can be tricked into logging a user into a site the attacker controls. This lets a remote attacker steal the user’s authenticated session and act as that user on other sites. Upgrade the module to version 7.x‑1.3 or later, or disable it if you cannot apply the update.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
browserid_project browserid 7.x-1.1
7.x-1.2
cpe:2.3:a:browserid_project:browserid:7.x-1.1:*:*:*:*:*:*:*
Original advisory text
Cross-site request forgery (CSRF) vulnerability in the BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users f...
Cross-site request forgery (CSRF) vulnerability in the BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that login a user to another web site.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.8 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published27 Jun 2012
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2012-2713 · NVD
Track software like this
Free during beta