CVE-2015-3380

Опубликовано: 21 апр. 2015

Источник: nvd

CVSS2: 5.8

EPSS Низкий

Описание

Multiple cross-site request forgery (CSRF) vulnerabilities in the Feature Set module for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable or (2) disable a module via unspecified vectors.

Комментарий

Per the advisory: "A malicious user can cause an administrator to enable and disable modules by getting the administrator's browser to make a request to a specially-crafted URL." Only integrity and availability are affected.

Ссылки

http://www.openwall.com/lists/oss-security/2015/02/13/12
http://www.securityfocus.com/bid/72617
https://www.drupal.org/node/2424409
Patch
Vendor Advisory
http://www.openwall.com/lists/oss-security/2015/02/13/12
http://www.securityfocus.com/bid/72617
https://www.drupal.org/node/2424409
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:funnymonkey:feature_set:*:*:*:*:*:drupal:*:*

Версия до 7.x-1.0-beta1 (включая)

EPSS

Процентиль: 32%

0.00126

Низкий

5.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-r5p3-w6gj-hhc5

github

больше 3 лет назад