Описание
The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the "send scheduled newsletters" permission to inject arbitrary PHP code into the scheduling form, which is later executed by cron.
Уязвимые конфигурации
Конфигурация 1
Одновременно
Одно из
cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.0:*:*:*:*:*:*:*
cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.0:beta2:*:*:*:*:*:*
cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.0:beta3:*:*:*:*:*:*
cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.0:beta4:*:*:*:*:*:*
cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.1:*:*:*:*:*:*:*
cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.2:*:*:*:*:*:*:*
cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.3:*:*:*:*:*:*:*
cpe:2.3:a:simplenews_scheduler_project:simplenews_scheduler:6.x-2.x:dev:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*
EPSS
Процентиль: 65%
0.00513
Низкий
6 Medium
CVSS2
Дефекты
CWE-94
Связанные уязвимости
github
около 3 лет назад
The Simplenews Scheduler module 6.x-2.x before 6.x-2.4 for Drupal allows remote authenticated users with the "send scheduled newsletters" permission to inject arbitrary PHP code into the scheduling form, which is later executed by cron.
EPSS
Процентиль: 65%
0.00513
Низкий
6 Medium
CVSS2
Дефекты
CWE-94