PT-2009-4802 · Drupal · Drupal

Sumit Datta · Published 2009-07-08 · Updated 2021-04-21 · CVE-2009-2374

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 5.x before 5.19 Drupal versions 6.x before 6.13

Description The issue arises from improper sanitization of failed login attempts for pages containing sortable tables. This can lead to the exposure of usernames and passwords through two main vectors: (1) the HTTP referer header of external web sites that are visited from those links, (2) when page caching is enabled, the Drupal page cache.

Recommendations For Drupal versions 5.x before 5.19, update to version 5.19 or later to resolve the issue. For Drupal versions 6.x before 6.13, update to version 6.13 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2009-2374

DSA-1930-1

Affected Products

Drupal

References · 6

• http://drupal.org/node/507572 · Vendor Advisory
• http://osvdb.org/55524 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-2374 · Security Note
• http://secunia.com/advisories/35681 · Note
• http://secunia.com/advisories/35657 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2374 · Note