Lucene search

MitreCVE-2008-0271

HistoryJan 15, 2008 - 8:00 p.m.

CVE-2008-0271

2008-01-1520:00:00

CWE-352

mitre

web.nvd.nist.gov

cve-2008-0271

bueditor

drupal

cross-site request forgery

csrf

security vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

6.8

Confidence

High

EPSS

0.002

Percentile

54.3%

JSON

The editor deletion form in BUEditor 4.7.x before 4.7.x-1.0 and 5.x before 5.x-1.1, a module for Drupal, does not follow Drupal’s Forms API submission model, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete custom editor interfaces.

Affected configurations

Nvd

Node

drupalbueditorRange≤4.7.x-1.0

drupalbueditorRange≤5.x-1.0

VendorProductVersionCPE
drupalbueditor*cpe:2.3:a:drupal:bueditor:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
drupal	bueditor	*	cpe:2.3:a:drupal:bueditor::::::::

References

drupal.org/node/208534

secunia.com/advisories/28418

www.vupen.com/english/advisories/2008/0128

exchange.xforce.ibmcloud.com/vulnerabilities/39614

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

6.8

Confidence

High

EPSS

0.002

Percentile

54.3%

JSON

Related for CVE-2008-0271