Описание
Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not use timeouts for signed requests, which allows remote attackers to impersonate other users and gain privileges via a replay attack that sends the same request.
Ссылки
- PatchVendor Advisory
- Patch
- PatchVendor Advisory
- Patch
Уязвимые конфигурации
Конфигурация 1
Одновременно
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
Одно из
cpe:2.3:a:marc_ingram:services:5.x-0.9:*:*:*:*:*:*:*
cpe:2.3:a:marc_ingram:services:5.x-0.91:*:*:*:*:*:*:*
cpe:2.3:a:marc_ingram:services:5.x-1.x-dev:*:*:*:*:*:*:*
cpe:2.3:a:marc_ingram:services:6.x-0.9:*:*:*:*:*:*:*
cpe:2.3:a:marc_ingram:services:6.x-0.11:*:*:*:*:*:*:*
cpe:2.3:a:marc_ingram:services:6.x-0.12:*:*:*:*:*:*:*
cpe:2.3:a:marc_ingram:services:6.x-1.x-dev:*:*:*:*:*:*:*
EPSS
Процентиль: 70%
0.00658
Низкий
7.5 High
CVSS2
Дефекты
CWE-310
Связанные уязвимости
github
около 3 лет назад
Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not use timeouts for signed requests, which allows remote attackers to impersonate other users and gain privileges via a replay attack that sends the same request.
EPSS
Процентиль: 70%
0.00658
Низкий
7.5 High
CVSS2
Дефекты
CWE-310