Lucene search

[email protected]CVE-2012-1633

HistorySep 20, 2012 - 12:55 a.m.

CVE-2012-1633

2012-09-2000:55:05

CWE-352

[email protected]

web.nvd.nist.gov

cve-2012-1633

cross-site request forgery

csrf vulnerability

password policy module

drupal

remote attackers

hijack authentication

administrative users

unblock user

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.3 High

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

77.8%

JSON

Cross-site request forgery (CSRF) vulnerability in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote attackers to hijack the authentication of administrative users for requests that unblock a user.

Affected configurations

NVD

Node

erikwebbpassword_policyMatch6.x-1.0

erikwebbpassword_policyMatch6.x-1.0alpha2

erikwebbpassword_policyMatch6.x-1.0alpha3

erikwebbpassword_policyMatch6.x-1.0alpha4

erikwebbpassword_policyMatch6.x-1.0beta1

erikwebbpassword_policyMatch6.x-1.1

erikwebbpassword_policyMatch6.x-1.2

erikwebbpassword_policyMatch6.x-1.3

erikwebbpassword_policyMatch7.x-1.0beta3

AND

drupaldrupalMatch-

CPENameOperatorVersion
erikwebb:password_policyerikwebb password policyeq6.x-1.0
erikwebb:password_policyerikwebb password policyeq6.x-1.1
erikwebb:password_policyerikwebb password policyeq6.x-1.2
erikwebb:password_policyerikwebb password policyeq6.x-1.3
erikwebb:password_policyerikwebb password policyeq7.x-1.0

CPE	Name	Operator	Version
erikwebb:password_policy	erikwebb password policy	eq	6.x-1.0
erikwebb:password_policy	erikwebb password policy	eq	6.x-1.1
erikwebb:password_policy	erikwebb password policy	eq	6.x-1.2
erikwebb:password_policy	erikwebb password policy	eq	6.x-1.3
erikwebb:password_policy	erikwebb password policy	eq	7.x-1.0