PRIOn knowledge basePRION:CVE-2012-2097

HistoryAug 14, 2012 - 9:55 p.m.

Cross site request forgery (csrf)

2012-08-1421:55:00

PRIOn knowledge base

www.prio-n.com

7.7 High

AI Score

Confidence

Low

0.009 Low

EPSS

Percentile

83.0%

JSON

Cross-site request forgery (CSRF) vulnerability in the Autosave module 6.x before 6.x-2.10 and 7.x-2.x before 7.x-2.0 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests involving “submitting saved results to a node.”

CPENameOperatorVersion
autosaveeq<= 6.x-2.9
autosaveeq6.120.20
autosaveeq6.120.21
autosaveeq6.120.22
autosaveeq6.120.23
autosaveeq6.120.24
autosaveeq6.120.25
autosaveeq6.120.26
autosaveeq6.120.27
autosaveeq6.120.28

Name	Operator	Version
autosave	eq	<= 6.x-2.9
autosave	eq	6.120.20
autosave	eq	6.120.21
autosave	eq	6.120.22
autosave	eq	6.120.23
autosave	eq	6.120.24
autosave	eq	6.120.25
autosave	eq	6.120.26
autosave	eq	6.120.27
autosave	eq	6.120.28

Rows per page:

1-10 of 121

References

drupalcode.org/project/autosave.git/commitdiff/39f7fb0

drupalcode.org/project/autosave.git/commitdiff/f7bfd2d

www.openwall.com/lists/oss-security/2012/04/11/4

www.openwall.com/lists/oss-security/2012/04/12/2

www.securityfocus.com/bid/52985

drupal.org/node/1525998

drupal.org/node/1528864

drupal.org/node/1528906

exchange.xforce.ibmcloud.com/vulnerabilities/74838