PT-2013-1825 · Drupal · Drupal Nodewords: D6 Meta Tags

Forest Monsen · Publicado 2013-01-03 · Atualizado 2013-01-03 · CVE-2012-5654

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal Nodewords: D6 Meta Tags module versions prior to 6.x-1.14

Description The issue arises when the module is configured to automatically generate description meta tags from node text. It fails to properly filter node content, potentially allowing remote attackers to obtain sensitive information by reading the description, dc.description, or og:description meta tags.

Recommendations For versions prior to 6.x-1.14, update to version 6.x-1.14 or later to resolve the issue. As a temporary workaround, consider disabling the automatic generation of description meta tags from node text until the update is applied. Restrict access to sensitive node content to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2012-5654

Produtos afetados

Drupal Nodewords: D6 Meta Tags

Referências · 4

• http://drupal.org/node/1859208 · Correção
• http://drupal.org/node/1859282 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-5654 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/12/20/1 · Nota