PT-2014-8852 · Drupal · Services

Published 2014-12-01 · Updated 2014-12-01 · CVE-2014-9152

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Services module versions 7.x-3.x before 7.x-3.10

Description The issue concerns the user resource create function in the Services module, which uses a default password of 1 when creating new user accounts. This makes it easier for remote attackers to guess the password via a brute force attack.

Recommendations For versions prior to 7.x-3.10, update to version 7.x-3.10 or later to resolve the issue. As a temporary workaround, consider disabling the user resource create function until a patch is available. Restrict access to the Services module to minimize the risk of exploitation. Avoid using the default password creation mechanism in the affected module until the issue is resolved.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2014-9152

Affected Products

Services

References · 4

• http://cgit.drupalcode.org/services/commit/?id=809aafa · Vendor Advisory
• https://drupal.org/node/2344389 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9152 · Security Note
• https://drupal.org/node/2344423 · Vendor Advisory