PT-2015-6571 · Drupal · Drupal Open Graph Importer

Pere Orga · Publicado 2015-06-15 · Atualizado 2016-06-09 · CVE-2015-4389

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Open Graph Importer (og tag importer) versions 7.x-1.x

Description The issue concerns the Open Graph Importer module for Drupal, which fails to properly check the create permission for content types created during import. This allows remote authenticated users to bypass intended restrictions by leveraging the "import og tag importer" permission.

Recommendations For Drupal Open Graph Importer (og tag importer) versions 7.x-1.x, consider restricting the "import og tag importer" permission to trusted users until a patch is available. As a temporary workaround, review and manually verify the permissions for all content types created during import to ensure they align with intended access controls.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-4389

Produtos afetados

Drupal Open Graph Importer

Referências · 4

• https://drupal.org/node/2463891 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/04/25/6 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-4389 · Nota de Segurança
• http://securityfocus.com/bid/74354 · Nota