Описание
Multiple cross-site request forgery (CSRF) vulnerabilities in the "My Account" feature in PHPList Integration module 5 before 5.x-1.2 and 6 before 6.x-1.1 for Drupal allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) subscribing or (2) unsubscribing to mailing lists.
Ссылки
- Patch
- Patch
- PatchVendor Advisory
- Vendor Advisory
- Patch
- Patch
- Patch
- PatchVendor Advisory
- Vendor Advisory
- Patch
Уязвимые конфигурации
Конфигурация 1
Одновременно
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
Одно из
cpe:2.3:a:paul_beaney:phplist:5.x-1.0:*:*:*:*:*:*:*
cpe:2.3:a:paul_beaney:phplist:5.x-1.1:*:*:*:*:*:*:*
cpe:2.3:a:paul_beaney:phplist:5.x-1.x:dev:*:*:*:*:*:*
cpe:2.3:a:paul_beaney:phplist:6.x-1.0:*:*:*:*:*:*:*
cpe:2.3:a:paul_beaney:phplist:6.x-1.x:dev:*:*:*:*:*:*
EPSS
Процентиль: 42%
0.00199
Низкий
6.8 Medium
CVSS2
Дефекты
CWE-352
Связанные уязвимости
github
около 3 лет назад
Multiple cross-site request forgery (CSRF) vulnerabilities in the "My Account" feature in PHPList Integration module 5 before 5.x-1.2 and 6 before 6.x-1.1 for Drupal allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) subscribing or (2) unsubscribing to mailing lists.
EPSS
Процентиль: 42%
0.00199
Низкий
6.8 Medium
CVSS2
Дефекты
CWE-352