CVE-2013-6386

Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to
generate random numbers, which uses predictable seeds and allows remote
attackers to predict security strings and bypass intended restrictions via
a brute force attack.