PT-2013-5877 · Drupal · Click2Sell Suite

Greg Knaddison · Publicado 2013-09-25 · Atualizado 2017-08-29 · CVE-2013-5937

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Click2Sell Suite module versions 6.x-1.x

Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that delete database information. This is achieved through vectors involving the Drupal Form API.

Recommendations For Click2Sell Suite module versions 6.x-1.x, consider disabling the module until a patch is available to prevent exploitation. Restrict access to the module's functionality to minimize the risk of unauthorized database modifications. Avoid using the module for sensitive operations until the issue is resolved.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2013-5937

Produtos afetados

Click2Sell Suite

Referências · 6

• http://seclists.org/fulldisclosure/2013/Sep/64 · Nota
• http://osvdb.org/97203 · Nota
• http://openwall.com/lists/oss-security/2013/10/21/5 · Nota
• https://drupal.org/node/2087055 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/87052 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-5937 · Nota de Segurança