CVE-2009-4066

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2009-4066
Multiple cross-site request forgery (CSRF) vulnerabilities in the "My Account" feature in PHPList Integration module 5 before 5.x-1.2 and 6 before 6.x-1.1 for Drupal allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) subscribing or (2) unsubscribing to mailing lists.

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://drupal.org/node/636398 Patch
http://drupal.org/node/636400 Patch
http://drupal.org/node/636412 Patch Vendor Advisory
http://osvdb.org/60283
http://secunia.com/advisories/37434 Vendor Advisory
http://www.securityfocus.com/bid/37054 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/54336
http://drupal.org/node/636398 Patch
http://drupal.org/node/636400 Patch
http://drupal.org/node/636412 Patch Vendor Advisory
http://osvdb.org/60283
http://secunia.com/advisories/37434 Vendor Advisory
http://www.securityfocus.com/bid/37054 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/54336
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
OR cpe:2.3:a:paul_beaney:phplist:5.x-1.0:*:*:*:*:*:*:*
cpe:2.3:a:paul_beaney:phplist:5.x-1.1:*:*:*:*:*:*:*
cpe:2.3:a:paul_beaney:phplist:5.x-1.x:dev:*:*:*:*:*:*
cpe:2.3:a:paul_beaney:phplist:6.x-1.0:*:*:*:*:*:*:*
cpe:2.3:a:paul_beaney:phplist:6.x-1.x:dev:*:*:*:*:*:*
History

21 Nov 2024, 01:08

Type Values Removed Values Added
References () http://drupal.org/node/636398 - Patch () http://drupal.org/node/636398 - Patch
References () http://drupal.org/node/636400 - Patch () http://drupal.org/node/636400 - Patch
References () http://drupal.org/node/636412 - Patch, Vendor Advisory () http://drupal.org/node/636412 - Patch, Vendor Advisory
References () http://osvdb.org/60283 - () http://osvdb.org/60283 -
References () http://secunia.com/advisories/37434 - Vendor Advisory () http://secunia.com/advisories/37434 - Vendor Advisory
References () http://www.securityfocus.com/bid/37054 - Patch () http://www.securityfocus.com/bid/37054 - Patch
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/54336 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/54336 -
Information

Published : 2009-11-24 02:30

Updated : 2024-11-21 01:08

NVD link : CVE-2009-4066

Mitre link : CVE-2009-4066

CVE.ORG link : CVE-2009-4066

JSON object : View

Products Affected

drupal

  • drupal

paul_beaney

  • phplist
CWE
CWE-352

Cross-Site Request Forgery (CSRF)