PT-2014-2840 · Drupal · Payment For Webform

Forest Monsen · Publicado 2014-10-25 · Atualizado 2014-10-31 · CVE-2013-4594

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Payment for Webform module versions 7.x-1.x before 7.x-1.5

Description The issue allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment, due to the lack of access restriction by anonymous users.

Recommendations For Payment for Webform module versions 7.x-1.x before 7.x-1.5, update to version 7.x-1.5 or later to resolve the issue.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2013-4594

Produtos afetados

Payment For Webform

Referências · 5

• http://secunia.com/advisories/55431 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4594 · Nota de Segurança
• https://drupal.org/node/2128345 · Correção
• https://drupal.org/node/2129373 · Aviso do Fabricante
• http://seclists.org/oss-sec/2013/q4/317 · Nota