Open redirect in Drupal - CVE-2012-0825
Published: September 15, 2016
Vulnerability identifier: #VU475
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2012-0825
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Drupal
Affected software:
Drupal
Drupal
Detailed vulnerability description
The vulnerability allows a remote user to get access to valid user's data and modify it.
The weakness exists due to flaws in Attribute Exchange (AX) implement. Using of signed attributes getting through AX allows a malicious user to modify user's information.
Successful exploitation of the vulnerability may result in attacker's permission to modify target user's data.
The weakness exists due to flaws in Attribute Exchange (AX) implement. Using of signed attributes getting through AX allows a malicious user to modify user's information.
Successful exploitation of the vulnerability may result in attacker's permission to modify target user's data.
How to mitigate CVE-2012-0825
Update 6.x to 6.23.
https://www.drupal.org/node/1425082
Update 7.x to 7.11.
https://www.drupal.org/node/1425092
https://www.drupal.org/node/1425082
Update 7.x to 7.11.
https://www.drupal.org/node/1425092