Detections
Analytics
FreeBSD : drupal -- multiple vulnerabilities (10720fe8-51e0-11e1-91c1-00215c6a37bb)
medium Nessus Plugin ID 57857
Language:
Synopsis
The remote FreeBSD host is missing one or more security-related updates.Description
Drupal development team reports : Cross Site Request Forgery vulnerability in Aggregator module CVE: CVE-2012-0826A CSRF vulnerability can force an aggregator feed to update. Since some services are rate-limited (e.g. Twitter limits requests to 150 per hour) this could lead to a denial of service.
This issue affects Drupal 6.x and 7.x. OpenID not verifying signed attributes in SREG and AX CVE: CVE-2012-0825
A group of security researchers identified a flaw in how some OpenID relying parties implement Attribute Exchange (AX). Not verifying that attributes being passed through AX have been signed could allow an attacker to modify users' information.
This issue affects Drupal 6.x and 7.x. Access bypass in File module CVE: CVE-2012-0827
When using private files in combination with certain field access modules, the File module will allow users to download the file even if they do not have access to view the field it was attached to.
This issue affects Drupal 7.x only.
Solution
Update the affected packages.See Also
Plugin Details
Severity: Medium
ID: 57857
File Name: freebsd_pkg_10720fe851e011e191c100215c6a37bb.nasl
Version: 1.7
Type: local
Family: FreeBSD Local Security Checks
Published: 2/8/2012
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:drupal6, p-cpe:/a:freebsd:freebsd:drupal7, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Patch Publication Date: 2/7/2012
Vulnerability Publication Date: 2/1/2012