TI-2014-02783 Aliases CVE-2014-3453 GHSA-7px2-x6xv-5jgf

Eval injection vulnerability in the flag_import_form_validate function in…

LOW 33CWE-94Published 2014-05-17 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: Low
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

Eval injection vulnerability in the flag_import_form_validate function in includes/flag.export.inc in the Flag module 7.x-3.0, 7.x-3.5, and earlier for Drupal allows remote authenticated administrators to execute arbitrary PHP code via the "Flag import code" text area to admin/structure/flags/import. NOTE: this issue could also be exploited by other attackers if the administrator ignores a security warning on the permissions assignment page.

Why it matters now

EPSS 0.02119 81st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPE	Versions	Role	Vendor
cpe:2.3:a:flag_module_project:flag::::::drupal::*	up to 7.x-3.5	Vulnerable	Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.0:-::::drupal::*	7.x-3.0	Vulnerable	Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha1::::drupal::*	7.x-3.0 alpha1	Vulnerable	Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha2::::drupal::*	7.x-3.0 alpha2	Vulnerable	Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha3::::drupal::*	7.x-3.0 alpha3	Vulnerable	Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha4::::drupal::*	7.x-3.0 alpha4	Vulnerable	Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.0:beta1::::drupal::*	7.x-3.0 beta1	Vulnerable	Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.0:rc1::::drupal::*	7.x-3.0 rc1	Vulnerable	Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.1:::::drupal::	7.x-3.1	Vulnerable	Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.2:::::drupal::	7.x-3.2	Vulnerable	Flag Module Project

cpe:2.3:a:flag_module_project:flag:*:*:*:*:*:drupal:*:* Versions up to 7.x-3.5 Vulnerable ·Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.0:-:*:*:*:drupal:*:* Versions 7.x-3.0 Vulnerable ·Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha1:*:*:*:drupal:*:* Versions 7.x-3.0 alpha1 Vulnerable ·Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha2:*:*:*:drupal:*:* Versions 7.x-3.0 alpha2 Vulnerable ·Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha3:*:*:*:drupal:*:* Versions 7.x-3.0 alpha3 Vulnerable ·Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha4:*:*:*:drupal:*:* Versions 7.x-3.0 alpha4 Vulnerable ·Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.0:beta1:*:*:*:drupal:*:* Versions 7.x-3.0 beta1 Vulnerable ·Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.0:rc1:*:*:*:drupal:*:* Versions 7.x-3.0 rc1 Vulnerable ·Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.1:*:*:*:*:drupal:*:* Versions 7.x-3.1 Vulnerable ·Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.2:*:*:*:*:drupal:*:* Versions 7.x-3.2 Vulnerable ·Flag Module Project

Show 3 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:flag_module_project:flag:7.x-3.3:::::drupal::	7.x-3.3	Vulnerable	Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.4:::::drupal::	7.x-3.4	Vulnerable	Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.x:dev::::drupal::*	7.x-3.x dev	Vulnerable	Flag Module Project

cpe:2.3:a:flag_module_project:flag:7.x-3.3:*:*:*:*:drupal:*:* Versions 7.x-3.3 Vulnerable ·Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.4:*:*:*:*:drupal:*:* Versions 7.x-3.4 Vulnerable ·Flag Module Project
cpe:2.3:a:flag_module_project:flag:7.x-3.x:dev:*:*:*:drupal:*:* Versions 7.x-3.x dev Vulnerable ·Flag Module Project

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2014-3453
2026-10-03 Alias added: GHSA-7px2-x6xv-5jgf

References

Exploit 1

20140509 Drupal Flag 7.x-3.5 Module Vulnerability report: Arbitrary code execution due to improper input handling in flag importer

Other 2

TI-2025-13298 XSS in Drupal 7 Flag Module CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences