PT-2014-2840 · Drupal · Payment For Webform

Forest Monsen · Published 2014-10-25 · Updated 2014-10-31 · CVE-2013-4594

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Payment for Webform module versions 7.x-1.x before 7.x-1.5

Description The issue allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment, due to the lack of access restriction by anonymous users.

Recommendations For Payment for Webform module versions 7.x-1.x before 7.x-1.5, update to version 7.x-1.5 or later to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-4594

Affected Products

Payment For Webform

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2013-4594 · Security Note
• https://drupal.org/node/2128345 · Patch
• https://drupal.org/node/2129373 · Vendor Advisory
• http://secunia.com/advisories/55431 · Note
• http://seclists.org/oss-sec/2013/q4/317 · Note