漏洞信息详情

Drupal Prior 跨站请求伪造漏洞

• CNNVD编号：CNNVD-200801-202
• 危害等级： 中危
  
• CVE编号： CVE-2008-0272
• 漏洞类型： 跨站请求伪造
• 发布时间： 2008-01-15
• 威胁类型： 远程
• 更新时间： 2008-09-05
• 厂        商： drupal
• 漏洞来源： The Drupal securit...

漏洞简介

Drupal是Drupal社区所维护的一套用PHP语言开发的免费、开源的内容管理系统。 4.7.11 和 5.x以及 5.6以前的Drupal 4.7.x的aggregator module中的跨站请求验证真伪会允许远程黑客像特权用户那样从输入端删除项目。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接： Drupal Drupal 5.2 Drupal drupal-5.6.tar.gz http://ftp.drupal.org/files/projects/drupal-5.6.tar.gz Drupal Drupal 5.3 Drupal drupal-5.6.tar.gz http://ftp.drupal.org/files/projects/drupal-5.6.tar.gz Drupal Drupal 4.7 revision 1.2 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 5.1 Drupal drupal-5.6.tar.gz http://ftp.drupal.org/files/projects/drupal-5.6.tar.gz Drupal Drupal 5.0 Drupal drupal-5.6.tar.gz http://ftp.drupal.org/files/projects/drupal-5.6.tar.gz Drupal Drupal 4.6 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 5.1 revision 1.1 Drupal drupal-5.6.tar.gz http://ftp.drupal.org/files/projects/drupal-5.6.tar.gz Drupal Drupal 5.5 Drupal drupal-5.6.tar.gz http://ftp.drupal.org/files/projects/drupal-5.6.tar.gz Drupal Drupal 4.7 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.7 revision 1.15 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 5.4 Drupal drupal-5.6.tar.gz http://ftp.drupal.org/files/projects/drupal-5.6.tar.gz Drupal Drupal 4.0 .0 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.1 .0 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.2 .0 RC Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.4 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.4.1 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.4.2 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.4.3 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.5 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.5.1 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.5.2 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.5.2 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.5.3 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.5.4 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.5.5 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.5.6 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.5.7 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.5.8 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.6 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.6.1 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.6.10 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.6.11 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.6.2 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.6.3 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.6.4 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.6.5 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.6.6 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.6.7 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.6.8 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.6.9 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.7 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.7.1 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.7.10 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.7.2 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.7.3 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.7.3 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.7.4 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.7.4 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.7.5 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz vbDrupal vbDrupal 4.7.5 vbDrupal vbDrupal-4.7.11.0.zip http://downloads.sourceforge.net/vbdrupal/vbDrupal-4.7.11.0.zip?modtim e=1200153027&big_mirror=0 vbDrupal vbDrupal 4.7.6 vbDrupal vbDrupal-4.7.11.0.zip http://downloads.sourceforge.net/vbdrupal/vbDrupal-4.7.11.0.zip?modtim e=1200153027&big_mirror=0 vbDrupal vbDrupal 4.7.6 4 vbDrupal vbDrupal-4.7.11.0.zip http://downloads.sourceforge.net/vbdrupal/vbDrupal-4.7.11.0.zip?modtim e=1200153027&big_mirror=0 Drupal Drupal 4.7.6 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.7.7 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.7.8 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz Drupal Drupal 4.7.9 Drupal drupal-4.7.11.tar.gz http://ftp.drupal.org/files/projects/drupal-4.7.11.tar.gz vbDrupal vbDrupal 5.2 vbDrupal vbDrupal-5.6.0a.tar.gz http://downloads.sourceforge.net/vbdrupal/vbDrupal-5.6.0a.tar.gz?modti me=1200158794&big_mirror=0 vbDrupal vbDrupal 5.3 vbDrupal vbDrupal-5.6.0a.tar.gz http://downloads.sourceforge.net/vbdrupal/vbDrupal-5.6.0a.tar.gz?modti me=1200158794&big_mirror=0

参考网址

来源: BID 名称: 27238 链接:http://www.securityfocus.com/bid/27238 来源: XF 名称: drupal-aggregator-csrf(39617) 链接:http://xforce.iss.net/xforce/xfdb/39617 来源: VUPEN 名称: ADV-2008-0134 链接:http://www.vupen.com/english/advisories/2008/0134 来源: www.vbdrupal.org 链接:http://www.vbdrupal.org/forum/showthread.php?t=1349 来源: www.vbdrupal.org 链接:http://www.vbdrupal.org/forum/showthread.php?p=6878 来源: SECUNIA 名称: 28486 链接:http://secunia.com/advisories/28486 来源: SECUNIA 名称: 28422 链接:http://secunia.com/advisories/28422 来源: drupal.org 链接:http://drupal.org/node/208562 来源: VUPEN 名称: ADV-2008-0127 链接:http://www.frsirt.com/english/advisories/2008/0127

受影响实体

• Drupal Drupal:4.4.2  
• Drupal Drupal:4.4.3  
• Drupal Drupal:4.5  
• Drupal Drupal:4.5.1  
• Drupal Drupal:4.5.2  

补丁

暂无