PatchTheCVEcontext vulnerabilities and fixes
Recent CVEs affecting context, with upgrade or downgrade steps. 4 tracked.
context has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2015-01-15. Highest priority: CVE-2013-4446 (score 42/100).
- CVE-2015-1051 MEDIUM 5.8 DOWNGRADE MITIGATE Open redirect vulnerability in the Context UI module in the Context module 7.x-3.x before 7.x-3.6 for Drupal a
- CVE-2013-4446 MEDIUM 6.8 DOWNGRADE The _json_decode function in plugins/context_reaction_block.inc in the Context module 6.x-2.x before 6.x-3.2 a
- CVE-2013-4445 MEDIUM 4.9 DOWNGRADE The json rendering functionality in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for D
- CVE-2012-5655 MEDIUM 5.0 DOWNGRADE The Context module 6.x-3.x before 6.x-3.1 and 7.x-3.x before 7.x-3.0-beta6 for Drupal does not properly restri
FAQ
How do I fix context vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is context being exploited right now?
None of the tracked context CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which context CVE should I patch first?
CVE-2013-4446 currently ranks highest (42/100): The _json_decode function in plugins/context_reaction_block.inc in the Context module 6.x-2.x before 6.x-3.2 a.