CVE-2008-6909 Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not sign all required data in requests, which has unspecified impact, probably related to man-in-the-middle attacks that...
MediumCVSS 6.5
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not sign all required data in requests, which has unspecified impact, probably related to man-in-the-middle attacks that modify critical data and allow remote attackers to impersonate other users and gain privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| marc ingram services | = 5.x-0.9 | No fix listed |
| marc ingram services | = 5.x-0.91 | No fix listed |
| marc ingram services | = 5.x-1.x-dev | No fix listed |
| marc ingram services | = 6.x-0.9 | No fix listed |
| marc ingram services | = 6.x-0.11 | No fix listed |
| marc ingram services | = 6.x-0.12 | No fix listed |
| marc ingram services | = 6.x-1.x-dev | No fix listed |
References
- drupal.org patch vendor-advisory
- 50743 patch vdb-entry
- 32894 patch vdb-entry
- services-insecure-hash-weak-security(47458) vdb-entry
- services-request-security-bypass(52438) vdb-entry