PT-2008-4638 · Drupal · Drupal

Publicado 2008-07-18 · Atualizado 2021-04-15 · CVE-2008-3222

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Drupal versions 5.x through 5.8 Drupal versions 6.x through 6.2

Description: A session fixation issue allows remote attackers to hijack web sessions via unknown vectors when contributed modules terminate the current request during a login event.

Recommendations: For Drupal versions 5.x through 5.8, update to version 5.9 or later. For Drupal versions 6.x through 6.2, update to version 6.3 or later.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2008-3222

Produtos afetados

Drupal

Referências · 15

• http://securityfocus.com/bid/30168 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3222 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00527.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-3222 · Nota de Segurança
• http://openwall.com/lists/oss-security/2008/07/10/3 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-August/msg00016.html · Aviso do Fabricante
• http://drupal.org/node/286417 · Aviso do Fabricante
• https://t.me/cvenotify/13271 · Publicação no Telegram
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00551.html · Aviso do Fabricante
• http://securityfocus.com/bid/30359 · Correção
• http://secunia.com/advisories/31211 · Nota
• http://secunia.com/advisories/31079 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43706 · Nota
• http://drupal.org/node/280571 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=454849 · Correção