PT-2012-5418 · Drupal · Listhandler

Joshua Brauer · Publicado 2012-11-30 · Atualizado 2013-01-30 · CVE-2012-4470

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Listhandler module versions 6.x-1.x before 6.x-1.1 for Drupal

Description The issue concerns the Listhandler module for Drupal, where it fails to properly check permissions when importing emails. This allows remote comment authors to bypass access restrictions, potentially leading to unspecified impacts.

Recommendations For Listhandler module versions 6.x-1.x before 6.x-1.1, update to version 6.x-1.1 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-4470

Produtos afetados

Listhandler

Referências · 5

• http://securityfocus.com/bid/54376 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4470 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/10/04/3 · Nota
• http://drupal.org/node/1679412 · Aviso do Fabricante
• http://drupal.org/node/1819780 · Correção