PT-2009-6247 · Drupal · Phplist Integration Module+1

Published 2009-11-24 · Updated 2017-08-17 · CVE-2009-4066

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPList Integration module versions prior to 5.x-1.2 PHPList Integration module versions prior to 6.x-1.1

Description The issue affects the "My Account" feature in the PHPList Integration module for Drupal, where multiple cross-site request forgery (CSRF) vulnerabilities exist. These vulnerabilities allow remote attackers to hijack the authentication of arbitrary users via vectors related to subscribing or unsubscribing to mailing lists.

Recommendations For PHPList Integration module versions prior to 5.x-1.2, update to version 5.x-1.2 or later. For PHPList Integration module versions prior to 6.x-1.1, update to version 6.x-1.1 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2009-4066

Affected Products

Drupal

Phplist Integration Module

References · 8

• http://secunia.com/advisories/37434 · Vendor Advisory
• http://drupal.org/node/636400 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-4066 · Security Note
• http://securityfocus.com/bid/37054 · Patch
• http://drupal.org/node/636398 · Patch
• http://drupal.org/node/636412 · Vendor Advisory
• http://osvdb.org/60283 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54336 · Note