PT-2009-6247 · Drupal · Phplist Integration Module+1

Publicado 2009-11-24 · Atualizado 2017-08-17 · CVE-2009-4066

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPList Integration module versions prior to 5.x-1.2 PHPList Integration module versions prior to 6.x-1.1

Description The issue affects the "My Account" feature in the PHPList Integration module for Drupal, where multiple cross-site request forgery (CSRF) vulnerabilities exist. These vulnerabilities allow remote attackers to hijack the authentication of arbitrary users via vectors related to subscribing or unsubscribing to mailing lists.

Recommendations For PHPList Integration module versions prior to 5.x-1.2, update to version 5.x-1.2 or later. For PHPList Integration module versions prior to 6.x-1.1, update to version 6.x-1.1 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2009-4066

Produtos afetados

Drupal

Phplist Integration Module

Referências · 8

• http://osvdb.org/60283 · Nota
• http://secunia.com/advisories/37434 · Aviso do Fabricante
• http://drupal.org/node/636400 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2009-4066 · Nota de Segurança
• http://securityfocus.com/bid/37054 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54336 · Nota
• http://drupal.org/node/636398 · Correção
• http://drupal.org/node/636412 · Aviso do Fabricante