PT-2012-3046 · Drupal · Drupal Forward Module

Publicado 2012-02-14 · Atualizado 2017-08-29 · CVE-2012-1057

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal Forward module versions 6.x-1.x through 6.x-1.20 Drupal Forward module versions 7.x-1.x through 7.x-1.2

Description A cross-site request forgery (CSRF) issue exists in the clickthrough tracking functionality of the Forward module, potentially related to improper flood control. This allows remote attackers to hijack the authentication of administrators for requests that increase node rankings via the tracking code.

Recommendations For Drupal Forward module version 6.x-1.x, update to version 6.x-1.21 or later. For Drupal Forward module version 7.x-1.x, update to version 7.x-1.3 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2012-1057

Produtos afetados

Drupal Forward Module

Referências · 8

• http://drupal.org/node/1423722 · Correção
• http://securityfocus.com/bid/51826 · Nota
• http://drupalcode.org/project/forward.git/commitdiff/72158fdbfbf5a068938985e3d10ce1d8f969d9c3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1057 · Nota de Segurança
• http://drupal.org/node/1425150 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72922 · Nota
• http://osvdb.org/78817 · Nota
• http://secunia.com/advisories/47851 · Aviso do Fabricante