CVE-2014-3453

{"id": "CVE-2014-3453", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-05-17T19:55:03.543", "references": [{"url": "http://seclists.org/fulldisclosure/2014/May/44", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2014/05/12/2", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/67318", "source": "cve@mitre.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1096604", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Eval injection vulnerability in the flag_import_form_validate function in includes/flag.export.inc in the Flag module 7.x-3.0, 7.x-3.5, and earlier for Drupal allows remote authenticated administrators to execute arbitrary PHP code via the \"Flag import code\" text area to admin/structure/flags/import. NOTE: this issue could also be exploited by other attackers if the administrator ignores a security warning on the permissions assignment page."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n Eval en la funci\u00f3n flag_import_form_validate en includes/flag.export.inc en el m\u00f3dulo Flag 7.x-3.0, 7.x-3.5 y anteriores para Drupal permite a administradores remotos autenticados ejecutar c\u00f3digo PHP arbitrario a trav\u00e9s de la \u00e1rea de texto 'c\u00f3digo de importaci\u00f3n Flag' hacia admin/structure/flags/import. NOTA: este problema tambi\u00e9n podr\u00eda ser explotado por otros atacantes si el administrador ignora un aviso de seguridad en la p\u00e1gina de asignaci\u00f3n de permisos."}], "lastModified": "2014-05-19T16:32:02.917", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flag_module_project:flag:*:*:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "AA9AA3B2-53A6-4EA1-8EB3-A96216275671", "versionEndIncluding": "7.x-3.5"}, {"criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.0:-:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "2105271A-47DB-4B57-A921-D6E35DE47466"}, {"criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha1:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "DE2A8ADB-D5AE-454F-9693-43E5268266F5"}, {"criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha2:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "B68F7250-5A82-4893-9A05-E23B18CF37E1"}, {"criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha3:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "206DE964-539D-474D-8742-11D5CE59052E"}, {"criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.0:alpha4:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "339EDB57-8CCA-4D16-9E2E-9944F8F77AC6"}, {"criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.0:beta1:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "BBCF8C18-6E05-4DD3-A986-DE306AB3E7F5"}, {"criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.0:rc1:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "53310BDE-FB58-4932-B74B-28E4A24DBC68"}, {"criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.1:*:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "F48E13FD-CFCC-41F8-8127-87C819CEE7F6"}, {"criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.2:*:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "0729F914-0CAF-4C05-B978-A313F955732C"}, {"criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.3:*:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "E75BD487-C959-4D30-83D3-8FCFC38D0AE0"}, {"criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.4:*:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "F4D76F04-C3C2-4089-B5D5-4CCF4C2EE1BA"}, {"criteria": "cpe:2.3:a:flag_module_project:flag:7.x-3.x:dev:*:*:*:drupal:*:*", "vulnerable": true, "matchCriteriaId": "65B73028-BF40-4EFE-A4EC-5BF4E849F4F0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}