PT-2012-3046 · Drupal · Drupal Forward Module

Published 2012-02-14 · Updated 2017-08-29 · CVE-2012-1057

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal Forward module versions 6.x-1.x through 6.x-1.20 Drupal Forward module versions 7.x-1.x through 7.x-1.2

Description A cross-site request forgery (CSRF) issue exists in the clickthrough tracking functionality of the Forward module, potentially related to improper flood control. This allows remote attackers to hijack the authentication of administrators for requests that increase node rankings via the tracking code.

Recommendations For Drupal Forward module version 6.x-1.x, update to version 6.x-1.21 or later. For Drupal Forward module version 7.x-1.x, update to version 7.x-1.3 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2012-1057

Affected Products

Drupal Forward Module

References · 8

• http://drupal.org/node/1423722 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2012-1057 · Security Note
• http://drupal.org/node/1425150 · Vendor Advisory
• http://secunia.com/advisories/47851 · Vendor Advisory
• http://securityfocus.com/bid/51826 · Note
• http://drupalcode.org/project/forward.git/commitdiff/72158fdbfbf5a068938985e3d10ce1d8f969d9c3 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72922 · Note
• http://osvdb.org/78817 · Note