CVE-2012-2720 The Token Authentication (tokenauth) module 6.x-1.x before 6.x-1.7 for Drupal does not properly revert user sessions, which might allow remote attackers to perform requests with extra privileges.
MediumCVSS 5.0
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Token Authentication (tokenauth) module 6.x-1.x before 6.x-1.7 for Drupal does not properly revert user sessions, which might allow remote attackers to perform requests with extra privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| adam ross tokenauth | = 6.x-1.0 | No fix listed |
| adam ross tokenauth | = 6.x-1.1 | No fix listed |
| adam ross tokenauth | = 6.x-1.3 | No fix listed |
| adam ross tokenauth | = 6.x-1.4 | No fix listed |
| adam ross tokenauth | = 6.x-1.5 | No fix listed |
| adam ross tokenauth | = 6.x-1.6 | No fix listed |
| adam ross tokenauth | = 6.x-1.x-dev | No fix listed |
References
- drupal.org patch
- drupal.org patch vendor-advisory
- 49400 third-party-advisory
- [oss-security] 20120613 Re: CVE Request for Drupal contributed modules mailing-list
- 82727 vdb-entry
- 53840 vdb-entry
- tokenauth-usersession-security-bypass(76141) vdb-entry