PT-2012-5417 · Drupal · Drupal

Joshua Brauer · Publicado 2012-11-30 · Atualizado 2012-12-03 · CVE-2012-4469

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Hashcash module versions 6.x-2.x before 6.x-2.6 Drupal Hashcash module versions 7.x-2.x before 7.x-2.2

Description A cross-site scripting (XSS) issue exists in the Hashcash module for Drupal. This occurs when the "Log failed hashcash" option is enabled, and an invalid token is not properly handled by the Database logging module, allowing remote attackers to inject arbitrary web script or HTML.

Recommendations For Drupal Hashcash module version 6.x-2.x, update to version 6.x-2.6 or later. For Drupal Hashcash module version 7.x-2.x, update to version 7.x-2.2 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-4469

Produtos afetados

Drupal

Referências · 5

• http://drupal.org/node/1650790 · Correção
• http://openwall.com/lists/oss-security/2012/10/04/3 · Nota
• http://drupal.org/node/1650784 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2012-4469 · Nota de Segurança
• http://drupal.org/node/1663306 · Aviso do Fabricante