EUVD-2012-4416

Malware in sbrugna...

CVE-2012-4487

The Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions, which allows remote authenticated parent users to change their role by switching to a subuser they created...

CVE-2012-4486

Cross-site request forgery CSRF vulnerability in the Subuser module before 6.x-1.8 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that switch the user to a subuser via unspecified vectors...

CVE-2012-4487

The Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions, which allows remote authenticated parent users to change their role by switching to a subuser they created...

Code injection

The Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions, which allows remote authenticated parent users to change their role by switching to a subuser they created...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Subuser module before 6.x-1.8 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that switch the user to a subuser via unspecified vectors...

CVE-2012-4487

The Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions, which allows remote authenticated parent users to change their role by switching to a subuser they created...

CVE-2012-4486

The CVE-2012-4486 issue affects the Drupal Subuser module prior to 6.x-1.8, where a CSRF flaw could allow remote attackers to hijack another user’s session by switching to a subuser via unspecified vectors. Impact is unauthorized account switching (CSRF) with partial confidentiality/integrity/ava...

CVE-2012-4487

The CVE concerns Drupal’s Subuser module, prior to version 6.x-1.8. The vulnerability arises from insufficient checking of the "switch subuser" permission, enabling remote authenticated parent users to change their role by switching to a subuser they created. Practical impact is a potential privi...

CVE-2012-4487

The Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions, which allows remote authenticated parent users to change their role by switching to a subuser they created...

CVE-2012-4486: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Subuser module before 6.x-1.8 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that switch the user to a subuser via unspecified vectors...

CVE-2012-4487: Undefined Security Weakness

The Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions, which allows remote authenticated parent users to change their role by switching to a subuser they created...

PT-2012-5432

Name of the Vulnerable Software and Affected Versions Drupal Subuser module versions prior to 6.x-1.8 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of arbitrary users for requests that switch the user to a subuser. Recommendations For...