PT-2009-6225 · Drupal · Drupal Services Module

Published 2009-11-20 · Updated 2017-08-17 · CVE-2009-4044

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal Web Services module version 6.x

Description The issue concerns the Web Services module for Drupal, which fails to enforce proper access control. This allows remote attackers to exploit an API, although the specific vectors used are not detailed.

Recommendations For Drupal Web Services module version 6.x, update the module to a version that includes the necessary access control fixes.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-4044

Affected Products

Drupal Services Module

References · 5

• http://vupen.com/english/advisories/2009/3218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4044 · Security Note
• http://drupal.org/node/630244 · Vendor Advisory
• http://securityfocus.com/bid/37000 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54249 · Note