PT-2015-6957 · Drupal · Drupal Hsts Module

Publicado 2015-08-18 · Atualizado 2017-07-26 · CVE-2015-5505

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal HSTS module versions 6.x-1.x before 6.x-1.1 Drupal HSTS module versions 7.x-1.x before 7.x-1.2

Description The issue is related to the improper implementation of the "include subdomains" directive in the HTTP Strict Transport Security (HSTS) module for Drupal. This causes the HSTS policy to not be applied to subdomains, allowing man-in-the-middle attackers to have an unspecified impact.

Recommendations For Drupal HSTS module version 6.x-1.x, update to version 6.x-1.1 or later. For Drupal HSTS module version 7.x-1.x, update to version 7.x-1.2 or later.

Correção

Enumeração de Fraquezas

CWE-17

Identificadores relacionados

CVE-2015-5505

Produtos afetados

Drupal Hsts Module

Referências · 7

• http://openwall.com/lists/oss-security/2015/07/04/4 · Nota
• https://drupal.org/node/2507543 · Correção
• https://drupal.org/node/2507563 · Aviso do Fabricante
• https://drupal.org/node/2507539 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2015-5505 · Nota de Segurança
• http://securitytracker.com/id/1037633 · Nota
• http://securityfocus.com/bid/75276 · Nota