PT-2012-3390 · Drupal · Fill Pdf

Kurt Seifried · Publicado 2012-09-20 · Atualizado 2012-09-20 · CVE-2012-1625

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Fill PDF module versions 6.x-1.x prior to 6.x-1.16 Fill PDF module versions 7.x-1.x prior to 7.x-1.2

Description The issue allows remote authenticated users with administer PDFs privileges to execute arbitrary PHP code. This is due to an eval injection vulnerability in the fillpdf form export decode function.

Recommendations For Fill PDF module version 6.x-1.x, update to version 6.x-1.16 or later. For Fill PDF module version 7.x-1.x, update to version 7.x-1.2 or later.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2012-1625

Produtos afetados

Fill Pdf

Referências · 6

• http://secunia.com/advisories/47418 · Aviso do Fabricante
• http://drupal.org/node/1394428 · Aviso do Fabricante
• http://osvdb.org/78182 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1625 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/04/07/1 · Nota
• http://securityfocus.com/bid/51288 · Nota