CVE-2012-2713: Cross-site request forgery (CSRF) vulnerability in the BrowserID (Mozilla Persona) module 7.x-1.x before 7....

Security readout for executives and security teams

A vulnerable Drupal BrowserID module could let an attacker trick a logged-in user into making an unintended authentication request. The practical concern is account/session confusion around login actions, not server takeover. The bundle names affected versions before 7.x-1.3 and provides no evidence of active exploitation. Likely exposure is limited to Drupal 7 sites using the BrowserID/Mozilla Persona module 7.x-1.x before 7.x-1.3. Sites not using this contributed authentication module are not indicated as affected by the provided sources. Treat as a targeted legacy Drupal authentication risk. Prioritize if any public or partner-facing Drupal 7 site still uses BrowserID/Persona login. Otherwise, document non-exposure and retire the dependency where possible. Mitigation focus: Upgrade the BrowserID module to 7.x-1.3 or later where still applicable.; Disable or remove the module if BrowserID/Persona authentication is no longer required.; Review Drupal advisory and commit references before changing production authentication behavior..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.