Read the docs
TI-2013-03701 Aliases CVE-2013-4230GHSA-222h-9c7q-5wm5

The mm_webform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x…

Priority LOW 29CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

The mm_webform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restrict access to webform submissions, which allows remote authenticated users with the "Who can read data submitted to this webform" permission to delete arbitrary submissions via unspecified vectors.

Why it matters now

EPSS 0.01207 68th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 42

CPEVersionsRoleVendor
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.19:*:*:*:*:*:*:*6.x-6.19VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.22:*:*:*:*:*:*:*6.x-6.22VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.23:*:*:*:*:*:*:*6.x-6.23VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.24:*:*:*:*:*:*:*6.x-6.24VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.25:*:*:*:*:*:*:*6.x-6.25VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.26:*:*:*:*:*:*:*6.x-6.26VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.27:*:*:*:*:*:*:*6.x-6.27VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.29:*:*:*:*:*:*:*6.x-6.29VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.30:*:*:*:*:*:*:*6.x-6.30VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.31:*:*:*:*:*:*:*6.x-6.31VulnerableMonster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.19:*:*:*:*:*:*:* Versions 6.x-6.19 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.22:*:*:*:*:*:*:* Versions 6.x-6.22 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.23:*:*:*:*:*:*:* Versions 6.x-6.23 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.24:*:*:*:*:*:*:* Versions 6.x-6.24 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.25:*:*:*:*:*:*:* Versions 6.x-6.25 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.26:*:*:*:*:*:*:* Versions 6.x-6.26 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.27:*:*:*:*:*:*:* Versions 6.x-6.27 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.29:*:*:*:*:*:*:* Versions 6.x-6.29 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.30:*:*:*:*:*:*:* Versions 6.x-6.30 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.31:*:*:*:*:*:*:* Versions 6.x-6.31 Vulnerable ·Monster Menus Project
Show 32 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.32:*:*:*:*:*:*:*6.x-6.32VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.33:*:*:*:*:*:*:*6.x-6.33VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.34:*:*:*:*:*:*:*6.x-6.34VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.35:*:*:*:*:*:*:*6.x-6.35VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.36:*:*:*:*:*:*:*6.x-6.36VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.37:*:*:*:*:*:*:*6.x-6.37VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.38:*:*:*:*:*:*:*6.x-6.38VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.41:*:*:*:*:*:*:*6.x-6.41VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.42:*:*:*:*:*:*:*6.x-6.42VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.43:*:*:*:*:*:*:*6.x-6.43VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.44:*:*:*:*:*:*:*6.x-6.44VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.48:*:*:*:*:*:*:*6.x-6.48VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.53:*:*:*:*:*:*:*6.x-6.53VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.56:*:*:*:*:*:*:*6.x-6.56VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.57:*:*:*:*:*:*:*6.x-6.57VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.59:*:*:*:*:*:*:*6.x-6.59VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.60:*:*:*:*:*:*:*6.x-6.60VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.0:*:*:*:*:*:*:*7.x-1.0VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.1:*:*:*:*:*:*:*7.x-1.1VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.2:*:*:*:*:*:*:*7.x-1.2VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.3:*:*:*:*:*:*:*7.x-1.3VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.4:*:*:*:*:*:*:*7.x-1.4VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.5:*:*:*:*:*:*:*7.x-1.5VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.6:*:*:*:*:*:*:*7.x-1.6VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.7:*:*:*:*:*:*:*7.x-1.7VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.8:*:*:*:*:*:*:*7.x-1.8VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.9:*:*:*:*:*:*:*7.x-1.9VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.10:*:*:*:*:*:*:*7.x-1.10VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.11:*:*:*:*:*:*:*7.x-1.11VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.12:*:*:*:*:*:*:*7.x-1.12VulnerableMonster Menus Project
cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.x:dev:*:*:*:*:*:*7.x-1.x devVulnerableMonster Menus Project
cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*not specified by NVDRunning onDrupal
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.32:*:*:*:*:*:*:* Versions 6.x-6.32 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.33:*:*:*:*:*:*:* Versions 6.x-6.33 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.34:*:*:*:*:*:*:* Versions 6.x-6.34 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.35:*:*:*:*:*:*:* Versions 6.x-6.35 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.36:*:*:*:*:*:*:* Versions 6.x-6.36 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.37:*:*:*:*:*:*:* Versions 6.x-6.37 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.38:*:*:*:*:*:*:* Versions 6.x-6.38 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.41:*:*:*:*:*:*:* Versions 6.x-6.41 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.42:*:*:*:*:*:*:* Versions 6.x-6.42 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.43:*:*:*:*:*:*:* Versions 6.x-6.43 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.44:*:*:*:*:*:*:* Versions 6.x-6.44 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.48:*:*:*:*:*:*:* Versions 6.x-6.48 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.53:*:*:*:*:*:*:* Versions 6.x-6.53 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.56:*:*:*:*:*:*:* Versions 6.x-6.56 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.57:*:*:*:*:*:*:* Versions 6.x-6.57 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.59:*:*:*:*:*:*:* Versions 6.x-6.59 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:6.x-6.60:*:*:*:*:*:*:* Versions 6.x-6.60 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.0:*:*:*:*:*:*:* Versions 7.x-1.0 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.1:*:*:*:*:*:*:* Versions 7.x-1.1 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.2:*:*:*:*:*:*:* Versions 7.x-1.2 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.3:*:*:*:*:*:*:* Versions 7.x-1.3 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.4:*:*:*:*:*:*:* Versions 7.x-1.4 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.5:*:*:*:*:*:*:* Versions 7.x-1.5 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.6:*:*:*:*:*:*:* Versions 7.x-1.6 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.7:*:*:*:*:*:*:* Versions 7.x-1.7 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.8:*:*:*:*:*:*:* Versions 7.x-1.8 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.9:*:*:*:*:*:*:* Versions 7.x-1.9 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.10:*:*:*:*:*:*:* Versions 7.x-1.10 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.11:*:*:*:*:*:*:* Versions 7.x-1.11 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.12:*:*:*:*:*:*:* Versions 7.x-1.12 Vulnerable ·Monster Menus Project
  • cpe:2.3:a:monster_menus_project:monster_menus:7.x-1.x:dev:*:*:*:*:*:* Versions 7.x-1.x dev Vulnerable ·Monster Menus Project
  • cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Drupal

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4230
  2. 2026-10-03 Alias added: GHSA-222h-9c7q-5wm5

References

Patch 2

Advisory 1

Other 1

  • TI-2024-12325 Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045 CVSS 3.1CRITICAL 9.1
  • TI-2026-56089 Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116 CVSS 3.1MEDIUM 6.1
  • TI-2015-06735 The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal… CVSS 2.0MEDIUM 5.0
  • TI-2024-12332 Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052 CVSS 3.1MEDIUM 4.3
  • TI-2013-03952 The Monster Menus module 7.x-1.x before 7.x-1.15 allows remote attackers to read… CVSS 2.0LOW 2.6
  • TI-2013-03700 Cross-site scripting (XSS) vulnerability in the Monster Menus module 7.x-1.x before… CVSS 2.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences