{"id": "E-194", "type": "dsquare", "bulletinFamily": "exploit", "title": "Drupal AES encryption File Disclosure", "description": "Information disclosure\n\nVulnerability Type: File Disclosure", "published": "2012-03-18T00:00:00", "modified": "2013-04-02T00:00:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "href": "", "reporter": "Dsquare Security", "references": ["https://vulners.com/OSVDB/OSVDB:70767", "https://vulners.com/BID/BID:46116"], "cvelist": ["CVE-2011-0899"], "lastseen": "2019-05-29T15:31:57", "viewCount": 12, "enchantments": {"score": {"value": 4.9, "vector": "NONE", "modified": "2019-05-29T15:31:57", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2011-0899"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310801842", "OPENVAS:801842"]}], "modified": "2019-05-29T15:31:57", "rev": 2}, "vulnersScore": 4.9}, "sourceData": "For the exploit source code contact DSquare Security sales team."}

{"cve": [{"lastseen": "2021-02-02T05:50:59", "description": "The AES encryption module 7.x-1.4 for Drupal leaves certain debugging code enabled in release, which records the plaintext password of the last logged-in user and allows remote attackers to gain privileges as that user.", "edition": 4, "cvss3": {}, "published": "2011-02-07T21:00:00", "title": "CVE-2011-0899", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-0899"], "modified": "2017-08-17T01:33:00", "cpe": ["cpe:/a:johan_lindskog:aes_encryption_module:7.x-1.4"], "id": "CVE-2011-0899", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0899", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:johan_lindskog:aes_encryption_module:7.x-1.4:*:*:*:*:*:*:*"]}], "openvas": [{"lastseen": "2017-09-04T14:19:46", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0899"], "description": "The host is running Drupal AES Encryption Module and is prone to\n information disclosure vulnerability.", "modified": "2017-08-30T00:00:00", "published": "2011-02-15T00:00:00", "id": "OPENVAS:801842", "href": "http://plugins.openvas.org/nasl.php?oid=801842", "type": "openvas", "title": "Drupal AES Encryption Module Information Disclosure Vulnerability", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_drupal_aes_module_info_disc_vuln.nasl 7024 2017-08-30 11:51:43Z teissa $\n#\n# Drupal AES Encryption Module Information Disclosure Vulnerability\n#\n# Authors:\n# Sooraj KS <kssooraj@secpod.com>\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_impact = \"Successful exploitation will allow attacker to obtain sensitive information\n that could aid in further attacks.\n Impact Level: Application\";\ntag_affected = \"Drupal AES Encryption Module 7.x-1.4\";\ntag_insight = \"The flaw is triggered when the module saves user passwords in a text file,\n which will disclose the password to a remote attacker who directly requests\n the file.\";\ntag_solution = \"Upgarade to Drupal AES Encryption Module 7.x-1.5 or later.\n For updates refer to http://drupal.org/node/1040728\";\ntag_summary = \"The host is running Drupal AES Encryption Module and is prone to\n information disclosure vulnerability.\";\n\nif(description)\n{\n script_id(801842);\n script_version(\"$Revision: 7024 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-08-30 13:51:43 +0200 (Wed, 30 Aug 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-02-15 08:14:35 +0100 (Tue, 15 Feb 2011)\");\n script_cve_id(\"CVE-2011-0899\");\n script_bugtraq_id(46116);\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_name(\"Drupal AES Encryption Module Information Disclosure Vulnerability\");\n script_xref(name : \"URL\" , value : \"http://drupal.org/node/1048998\");\n script_xref(name : \"URL\" , value : \"http://secunia.com/advisories/43185\");\n script_xref(name : \"URL\" , value : \"http://xforce.iss.net/xforce/xfdb/65112\");\n\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n script_category(ACT_ATTACK);\n script_copyright(\"Copyright (C) 2011 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"drupal_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_tag(name : \"impact\" , value : tag_impact);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n exit(0);\n}\n\n\ninclude(\"http_func.inc\");\ninclude(\"version_func.inc\");\ninclude(\"http_keepalive.inc\");\n\n## Get HTTP Port\nport = get_http_port(default:80);\nif(!port){\n exit(0);\n}\n\nif(dir = get_dir_from_kb(port:port,app:\"drupal\"))\n{\n ## Try to access login_edit_dump.txt\n req = http_get(item:string(dir, \"/login_edit_dump.txt\"), port:port);\n res = http_keepalive_send_recv(port:port, data:req);\n\n ## Check for the file status\n if(ereg(pattern:\"^HTTP/[0-9]\\.[0-9] 200 .*\", string:res))\n {\n security_message(port);\n exit(0);\n }\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2020-05-12T17:32:26", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0899"], "description": "The host is running Drupal AES Encryption Module and is prone to\n information disclosure vulnerability.", "modified": "2020-05-08T00:00:00", "published": "2011-02-15T00:00:00", "id": "OPENVAS:1361412562310801842", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310801842", "type": "openvas", "title": "Drupal AES Encryption Module Information Disclosure Vulnerability", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Drupal AES Encryption Module Information Disclosure Vulnerability\n#\n# Authors:\n# Sooraj KS <kssooraj@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.801842\");\n script_version(\"2020-05-08T11:13:33+0000\");\n script_tag(name:\"last_modification\", value:\"2020-05-08 11:13:33 +0000 (Fri, 08 May 2020)\");\n script_tag(name:\"creation_date\", value:\"2011-02-15 08:14:35 +0100 (Tue, 15 Feb 2011)\");\n script_cve_id(\"CVE-2011-0899\");\n script_bugtraq_id(46116);\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_name(\"Drupal AES Encryption Module Information Disclosure Vulnerability\");\n script_xref(name:\"URL\", value:\"http://drupal.org/node/1048998\");\n script_xref(name:\"URL\", value:\"http://secunia.com/advisories/43185\");\n script_xref(name:\"URL\", value:\"http://xforce.iss.net/xforce/xfdb/65112\");\n\n script_tag(name:\"qod_type\", value:\"remote_vul\");\n script_category(ACT_ATTACK);\n script_copyright(\"Copyright (C) 2011 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"drupal_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"drupal/installed\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation will allow attacker to obtain sensitive information\n that could aid in further attacks.\");\n\n script_tag(name:\"affected\", value:\"Drupal AES Encryption Module 7.x-1.4\");\n\n script_tag(name:\"insight\", value:\"The flaw is triggered when the module saves user passwords in a text file,\n which will disclose the password to a remote attacker who directly requests the file.\");\n\n script_tag(name:\"solution\", value:\"Upgarade to Drupal AES Encryption Module 7.x-1.5 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_tag(name:\"summary\", value:\"The host is running Drupal AES Encryption Module and is prone to\n information disclosure vulnerability.\");\n\n script_xref(name:\"URL\", value:\"http://drupal.org/node/1040728\");\n\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"version_func.inc\");\ninclude(\"http_keepalive.inc\");\n\nport = http_get_port(default:80);\n\nif(dir = get_dir_from_kb(port:port, app:\"drupal\")) {\n url = string(dir, \"/login_edit_dump.txt\");\n req = http_get(item:url, port:port);\n res = http_keepalive_send_recv(port:port, data:req);\n\n if(ereg(pattern:\"^HTTP/1\\.[01] 200\", string:res)) {\n report = http_report_vuln_url(port:port, url:url);\n security_message(port:port, data:report);\n exit(0);\n }\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}]}