Lucene search

Ubuntu.comUB:CVE-2015-6660

HistoryAug 24, 2015 - 12:00 a.m.

CVE-2015-6660

2015-08-2400:00:00

ubuntu.com

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

70.9%

JSON

The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not
properly validate the form token, which allows remote attackers to conduct
CSRF attacks that upload files in a different user’s account via vectors
related to “file upload value callbacks.”

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchdrupal7< anyUNKNOWN
ubuntu15.04noarchdrupal7< 7.32-1+deb8u5build0.15.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	drupal7	< any	UNKNOWN
ubuntu	15.04	noarch	drupal7	< 7.32-1+deb8u5build0.15.04.1	UNKNOWN

References

launchpad.net/bugs/cve/CVE-2015-6660

nvd.nist.gov/vuln/detail/CVE-2015-6660

security-tracker.debian.org/tracker/CVE-2015-6660

www.cve.org/CVERecord?id=CVE-2015-6660

www.drupal.org/SA-CORE-2015-003

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

70.9%

JSON

Related for UB:CVE-2015-6660