PT-2015-7311 · Drupal · Drupal

Abdullah Hussam · Publicado 2015-08-24 · Atualizado 2016-12-24 · CVE-2015-6660

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x before 6.37 Drupal versions 7.x before 7.39

Description The issue concerns the Form API in Drupal, which fails to properly validate the form token. This allows remote attackers to conduct CSRF attacks, enabling them to upload files into a different user's account. The attack vectors are related to "file upload value callbacks."

Recommendations For Drupal 6.x, update to version 6.37 or later. For Drupal 7.x, update to version 7.39 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2015-6660

DSA-3346-1

MGASA-2015-0328

Produtos afetados

Drupal

Referências · 28

• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6661 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165704.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/drupal7 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-6660 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6660 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165840.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6660 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-6660 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165733.html · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2015-0328 · Aviso do Fabricante
• https://drupal.org/drupal-7.39 · Nota
• https://security-tracker.debian.org/tracker/DSA-3346-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6665 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-6660 · Nota de Segurança