PT-2014-8852 · Drupal · Services

Publicado 2014-12-01 · Atualizado 2014-12-01 · CVE-2014-9152

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Services module versions 7.x-3.x before 7.x-3.10

Description The issue concerns the user resource create function in the Services module, which uses a default password of 1 when creating new user accounts. This makes it easier for remote attackers to guess the password via a brute force attack.

Recommendations For versions prior to 7.x-3.10, update to version 7.x-3.10 or later to resolve the issue. As a temporary workaround, consider disabling the user resource create function until a patch is available. Restrict access to the Services module to minimize the risk of exploitation. Avoid using the default password creation mechanism in the affected module until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2014-9152

Produtos afetados

Services

Referências · 4

• http://cgit.drupalcode.org/services/commit/?id=809aafa · Aviso do Fabricante
• https://drupal.org/node/2344389 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-9152 · Nota de Segurança
• https://drupal.org/node/2344423 · Aviso do Fabricante