PT-2008-1916 · Drupal · Drupal

Publicado 2008-01-15 · Atualizado 2017-08-08 · CVE-2008-0272

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 4.7.x before 4.7.11 Drupal versions 5.x before 5.6

Description A cross-site request forgery (CSRF) issue exists in the aggregator module, allowing remote attackers to delete items from a feed as privileged users.

Recommendations For Drupal versions 4.7.x before 4.7.11, update to version 4.7.11 or later. For Drupal versions 5.x before 5.6, update to version 5.6 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2008-0272

Produtos afetados

Drupal

Referências · 11

• http://secunia.com/advisories/28422 · Aviso do Fabricante
• http://vbdrupal.org/forum/showthread.php?t=1349 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0272 · Nota de Segurança
• http://vbdrupal.org/forum/showthread.php?p=6878 · Nota
• http://drupal.org/node/208562 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39617 · Nota
• http://vupen.com/english/advisories/2008/0127 · Nota
• http://vupen.com/english/advisories/2008/0134 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0272 · Nota
• http://securityfocus.com/bid/27238 · Correção
• http://secunia.com/advisories/28486 · Nota