CVE-2012-2080 Cross-site request forgery (CSRF) vulnerability in the Node Limit Number module before 6.x-1.2 for Drupal allows remote attackers to hijack the authentication of users with the administer node limitnu...
MediumCVSS 6.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site request forgery (CSRF) vulnerability in the Node Limit Number module before 6.x-1.2 for Drupal allows remote attackers to hijack the authentication of users with the administer node limitnumber permission for requests that delete limits.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| node limit number project node limitnumber | <= 6.x-1.1 | No fix listed |
| node limit number project node limitnumber | = 5.x-1.0 | No fix listed |
| node limit number project node limitnumber | = 5.x-1.1-1 | No fix listed |
| node limit number project node limitnumber | = 5.x-1.1-2 | No fix listed |
| node limit number project node limitnumber | = 5.x-1.1-3 | No fix listed |
| node limit number project node limitnumber | = 5.x-1.4 | No fix listed |
| node limit number project node limitnumber | = 5.x-1.x-dev | No fix listed |
| node limit number project node limitnumber | = 6.x-1.0 | No fix listed |
| node limit number project node limitnumber | = 6.x-2.0-alpha1 | No fix listed |
| node limit number project node limitnumber | = 6.x-2.0-alpha2 | No fix listed |
| node limit number project node limitnumber | = 6.x-2.0-beta1 | No fix listed |
| node limit number project node limitnumber | = 6.x-2.0-beta2 | No fix listed |
| node limit number project node limitnumber | = 6.x-2.x-dev | No fix listed |
References
- drupal.org patch
- drupal.org patch vendor-advisory
- drupalcode.org exploit patch
- 80684 vdb-entry
- 48597 third-party-advisory vendor-advisory
- [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) mailing-list
- 52816 vdb-entry
- drupal-modelimitnumber-unspecified-csrf(74525) vdb-entry