PT-2014-2830 · Drupal · Drupalauth

Quick Kangaroo · Publicado 2014-05-13 · Atualizado 2014-05-14 · CVE-2013-4552

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions drupalauth module versions prior to 1.2.2

Description The issue allows remote attackers to authenticate as an arbitrary user via the uid in a cookie. This is due to a flaw in the lib/Auth/Source/External.php file of the drupalauth module for simpleSAMLphp.

Recommendations For versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation. Avoid using the uid variable in cookies until the issue is resolved.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2013-4552

Produtos afetados

Drupalauth

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-4552 · Nota de Segurança
• http://openwall.com/lists/oss-security/2013/11/08/6 · Correção
• https://code.google.com/p/drupalauth/issues/detail?id=9 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/11/05/1 · Correção