FreeBSD : drupal -- cross site request forgery (4451a4c9-c05e-11dc-982e-001372fd0af2)

Medium Nessus Plugin ID 29950


The remote FreeBSD host is missing one or more security-related updates.


The Drupal Project reports :

The aggregator module fetches items from RSS feeds and makes them available on the site. The module provides an option to remove items from a particular feed. This has been implemented as a simple GET request and is therefore vulnerable to cross site request forgeries.
For example: Should a privileged user view a page containing an <img> tag with a specially constructed src pointing to a remove items URL, the items would be removed.


Update the affected packages.

See Also

Plugin Details

Severity: Medium

ID: 29950

File Name: freebsd_pkg_4451a4c9c05e11dc982e001372fd0af2.nasl

Version: $Revision: 1.11 $

Type: local

Published: 2008/01/14

Modified: 2013/06/21

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:drupal4, p-cpe:/a:freebsd:freebsd:drupal5, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2008/01/11

Vulnerability Publication Date: 2008/01/10

Reference Information

CVE: CVE-2008-0272

Secunia: 28422

CWE: 352