CVE-2009-3922
Published Nov 9, 2009
Last updated 7 years ago
Overview
- Description
- Multiple cross-site request forgery (CSRF) vulnerabilities in the User Protect module 5.x before 5.x-1.4 and 6.x before 6.x-1.3, a module for Drupal, allow remote attackers to hijack the authentication of administrators for requests that (1) delete the editing protection of a user or (2) delete a certain type of administrative-bypass rule.
- Source
- cve@mitre.org
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 6.8
- Impact score
- 6.4
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-352
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:chad_phillips:userprotect:5.x-1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2EA9A11F-AECA-462C-92BB-0D26B3C4E790"
},
{
"criteria": "cpe:2.3:a:chad_phillips:userprotect:5.x-1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E088B7B-C2A8-4352-A775-C376AC978FC6"
},
{
"criteria": "cpe:2.3:a:chad_phillips:userprotect:5.x-1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6D305ABE-9931-421D-8F7C-32F65DF11A70"
},
{
"criteria": "cpe:2.3:a:chad_phillips:userprotect:5.x-1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D9D82426-0F6B-4D55-89EB-7D75D2CFA7C2"
},
{
"criteria": "cpe:2.3:a:chad_phillips:userprotect:5.x-1.x-dev:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED0916EA-C9F9-40F0-971D-B759D289EC68"
},
{
"criteria": "cpe:2.3:a:chad_phillips:userprotect:6.x-1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F858AAB-644B-4B84-9479-9940423EBEBA"
},
{
"criteria": "cpe:2.3:a:chad_phillips:userprotect:6.x-1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E8A8137D-630E-4257-B437-A4961E134FC0"
},
{
"criteria": "cpe:2.3:a:chad_phillips:userprotect:6.x-1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4562E39D-A5A5-40EB-A913-7D1E8C81556D"
},
{
"criteria": "cpe:2.3:a:chad_phillips:userprotect:6.x-1.x-dev:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "46AEA85D-DA51-49A8-A69C-D99F5474F2D3"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
]