PT-2009-4802 · Drupal · Drupal

Sumit Datta · Publicado 2009-07-08 · Atualizado 2021-04-21 · CVE-2009-2374

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 5.x before 5.19 Drupal versions 6.x before 6.13

Description The issue arises from improper sanitization of failed login attempts for pages containing sortable tables. This can lead to the exposure of usernames and passwords through two main vectors: (1) the HTTP referer header of external web sites that are visited from those links, (2) when page caching is enabled, the Drupal page cache.

Recommendations For Drupal versions 5.x before 5.19, update to version 5.19 or later to resolve the issue. For Drupal versions 6.x before 6.13, update to version 6.13 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2009-2374

DSA-1930-1

Produtos afetados

Drupal

Referências · 6

• http://drupal.org/node/507572 · Aviso do Fabricante
• http://osvdb.org/55524 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2009-2374 · Nota de Segurança
• http://secunia.com/advisories/35681 · Nota
• http://secunia.com/advisories/35657 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2374 · Nota