PT-2015-6578 · Drupal · Drupal Keyword Research

Pere Orga · Publicado 2015-06-15 · Atualizado 2016-06-27 · CVE-2015-4396

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal Keyword Research module versions 6.x-1.x before 6.x-1.2

Description The issue allows remote attackers to hijack the authentication of users with the "kwresearch admin site keywords" permission for requests that create, delete, or set priorities to keywords.

Recommendations For versions prior to 6.x-1.2, update to version 6.x-1.2 or later to resolve the issue.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2015-4396

Produtos afetados

Drupal Keyword Research

Referências · 5

• https://drupal.org/node/2475591 · Aviso do Fabricante
• http://securityfocus.com/bid/74361 · Nota
• http://openwall.com/lists/oss-security/2015/04/25/6 · Nota
• https://drupal.org/node/2475953 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2015-4396 · Nota de Segurança