CVE-2008-4793

The node module API in Drupal 5.x before 5.11 allows remote attackers to bypass node validation and have unspecified other impact via unknown vectors related to contributed modules.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://drupal.org/node/318706	Patch Vendor Advisory
http://secunia.com/advisories/32200
http://www.openwall.com/lists/oss-security/2008/10/21/7
https://exchange.xforce.ibmcloud.com/vulnerabilities/45763

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:drupal:drupal::::::::
	cpe:2.3:a:drupal:drupal:5.0:::::::*
	cpe:2.3:a:drupal:drupal:5.0:beta1::::::
	cpe:2.3:a:drupal:drupal:5.0:beta2::::::
	cpe:2.3:a:drupal:drupal:5.0:rc1::::::
	cpe:2.3:a:drupal:drupal:5.0:rc2::::::
	cpe:2.3:a:drupal:drupal:5.1:::::::*
	cpe:2.3:a:drupal:drupal:5.2:::::::*
	cpe:2.3:a:drupal:drupal:5.3:::::::*
	cpe:2.3:a:drupal:drupal:5.4:::::::*
	cpe:2.3:a:drupal:drupal:5.5:::::::*
	cpe:2.3:a:drupal:drupal:5.6:::::::*
	cpe:2.3:a:drupal:drupal:5.7:::::::*
	cpe:2.3:a:drupal:drupal:5.8:::::::*
	cpe:2.3:a:drupal:drupal:5.9:::::::*

History

No history.

Information

Published : 2008-10-29 15:31

Updated : 2017-08-08 01:32

NVD link : CVE-2008-4793

Mitre link : CVE-2008-4793

CVE.ORG link : CVE-2008-4793

JSON object : View

Products Affected

drupal

drupal

CWE

CWE-264

Permissions, Privileges, and Access Controls

NVD-CWE-noinfo

{"id": "CVE-2008-4793", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2008-10-29T15:31:35.603", "references": [{"url": "http://drupal.org/node/318706", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/32200", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2008/10/21/7", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45763", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}, {"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The node module API in Drupal 5.x before 5.11 allows remote attackers to bypass node validation and have unspecified other impact via unknown vectors related to contributed modules."}, {"lang": "es", "value": "El API del m\u00f3dulo nodo en Drupal 5.x anterior a 5.11 permite a un atacante remoto evitar la validaci\u00f3n del nodo, y tiene otros impactos por medio de ataques desconocidos relacionados con los m\u00f3dulos contribu\u00eddos."}], "lastModified": "2017-08-08T01:32:55.517", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "482347F6-0F92-4B6F-ACA9-7F6875D32726", "versionEndIncluding": "5.10"}, {"criteria": "cpe:2.3:a:drupal:drupal:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDBE79A6-5762-4A7C-8FDA-C11FFFDCFC9B"}, {"criteria": "cpe:2.3:a:drupal:drupal:5.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45BE66AB-3491-42CB-8594-AB041D15EA23"}, {"criteria": "cpe:2.3:a:drupal:drupal:5.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6334858-DF62-467A-9126-6F0AD32D325F"}, {"criteria": "cpe:2.3:a:drupal:drupal:5.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A677D3A4-F15C-4287-94B3-4CAADA4679D2"}, {"criteria": "cpe:2.3:a:drupal:drupal:5.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24DAB8DE-2459-484C-88B5-9812CFBDC60F"}, {"criteria": "cpe:2.3:a:drupal:drupal:5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5BCAB7B-DF79-4DB8-A5C4-731F251A02A2"}, {"criteria": "cpe:2.3:a:drupal:drupal:5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5AEAB73-F7A9-4C62-BCB6-1028DAF149DB"}, {"criteria": "cpe:2.3:a:drupal:drupal:5.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF34F79B-6B1B-45CA-82BA-24D4254B26DF"}, {"criteria": "cpe:2.3:a:drupal:drupal:5.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C4C5857-3690-4D74-B135-B6AB7E766FB7"}, {"criteria": "cpe:2.3:a:drupal:drupal:5.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1EC12E03-C4B0-4B2F-B70B-0EB19C450AB2"}, {"criteria": "cpe:2.3:a:drupal:drupal:5.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD50E551-7609-45EF-B2C6-3873D9CF8DB6"}, {"criteria": "cpe:2.3:a:drupal:drupal:5.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327712EE-8E9B-4A62-94A8-504C9CD2DE97"}, {"criteria": "cpe:2.3:a:drupal:drupal:5.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C4FC56B-0289-411C-88BF-144D7338D456"}, {"criteria": "cpe:2.3:a:drupal:drupal:5.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED3ECEA7-E6D3-43E8-A281-56C7F95A0B7F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}