PT-2014-5332 · Drupal · Flag

Murray Mcallister · Published 2014-05-17 · Updated 2014-05-19 · CVE-2014-3453

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Flag module versions 7.x-3.0 through 7.x-3.5

Description The issue allows remote authenticated administrators to execute arbitrary PHP code via the "Flag import code" text area in the /admin/structure/flags/import API endpoint. This could potentially be exploited by other attackers if the administrator ignores a security warning on the permissions assignment page.

Recommendations For Flag module versions 7.x-3.0 through 7.x-3.5, consider disabling the flag import form validate function until a patch is available to prevent exploitation. Restrict access to the /admin/structure/flags/import endpoint to minimize the risk of arbitrary PHP code execution. Avoid using the Flag import code text area in the affected endpoint until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2014-3453

Affected Products

Flag

References · 5

• 🔥 http://seclists.org/fulldisclosure/2014/May/44 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-3453 · Security Note
• http://securityfocus.com/bid/67318 · Note
• http://openwall.com/lists/oss-security/2014/05/12/2 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1096604 · Note