5.1
CVE-2013-0320
- EPSS 0.68%
- Veröffentlicht 27.03.2013 21:55:02
- Zuletzt bearbeitet 29.04.2026 01:13:23
- Erkennungen
LoginCross-site request forgery (CSRF) vulnerability in the Taxonomy Manager (taxonomy_manager) module 6.x-2.x before 6.x-2.2 and 7.x-1.x before 7.x-1.0-rc1 for Drupal allows remote attackers to hijack the authentication of users with 'administer taxonomy' permissions via unspecified vectors.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mattias Hutterer ≫ Taxonomy Manager Version 6.x-2.0
Mattias Hutterer ≫ Taxonomy Manager Version 6.x-2.1
Mattias Hutterer ≫ Taxonomy Manager Version 6.x-2.x Update dev
Mattias Hutterer ≫ Taxonomy Manager Version 7.x-1.0 Update alpha1
Mattias Hutterer ≫ Taxonomy Manager Version 7.x-1.0 Update alpha2
Mattias Hutterer ≫ Taxonomy Manager Version 7.x-1.0 Update alpha3
Mattias Hutterer ≫ Taxonomy Manager Version 7.x-1.0 Update alpha4
Mattias Hutterer ≫ Taxonomy Manager Version 7.x-1.0 Update beta1
Mattias Hutterer ≫ Taxonomy Manager Version 7.x-1.0 Update beta2
Mattias Hutterer ≫ Taxonomy Manager Version 7.x-1.0 Update beta3
Mattias Hutterer ≫ Taxonomy Manager Version 7.x-1.x Update dev
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.68% | 0.477 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 5.1 | 4.9 | 6.4 |
AV:N/AC:H/Au:N/C:P/I:P/A:P
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
http://www.openwall.com/lists/oss-security/2013/02/21/5
http://drupal.org/node/1922168
http://drupal.org/node/1922170
http://drupal.org/node/1922410
http://drupalcode.org/project/taxonomy_manager.git/commitdiff/2d05801
http://drupalcode.org/project/taxonomy_manager.git/commitdiff/595f1b3