PT-2012-6038 · Drupal · Email Field

Forest Monsen · Publicado 2012-12-26 · Atualizado 2012-12-27 · CVE-2012-5588

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Email Field module versions 6.x-1.x before 6.x-1.3 for Drupal

Description The issue allows remote attackers to email the stored address via unspecified vectors when the field contact field formatter is set to the full or teaser display mode and a field permission module is used. This occurs due to improper permission checking.

Recommendations For Email Field module versions 6.x-1.x before 6.x-1.3, update to version 6.x-1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the field contact field formatter when set to the full or teaser display mode until the update is applied.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-5588

Produtos afetados

Email Field

Referências · 4

• http://drupal.org/node/1852612 · Correção
• http://openwall.com/lists/oss-security/2012/11/29/2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5588 · Nota de Segurança
• http://drupal.org/node/1853214 · Aviso do Fabricante