PT-2008-5447 · Drupal · Drupal Mailhandler Module

Publicado 2008-09-19 · Atualizado 2017-08-08 · CVE-2008-4148

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal Mailhandler module versions 5.x before 5.x-1.4 Drupal Mailhandler module versions 6.x before 6.x-1.4

Description The issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to composing queries without using the Drupal database API.

Recommendations For Drupal Mailhandler module version 5.x, update to version 5.x-1.4 or later. For Drupal Mailhandler module version 6.x, update to version 6.x-1.4 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2008-4148

Produtos afetados

Drupal Mailhandler Module

Referências · 6

• http://secunia.com/advisories/31877 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/2616 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45216 · Nota
• http://drupal.org/node/309769 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2008-4148 · Nota de Segurança
• http://securityfocus.com/bid/31230 · Correção