CVE

Id
39011  
CVE No.
CVE-2009-1576  
Status
Candidate  
Description
Unspecified vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows user-assisted remote attackers to obtain sensitive information by tricking victims into visiting the front page of the site with a crafted URL and causing form data to be sent to an attacker-controlled site, possibly related to multiple / (slash) characters that are not properly handled by includes/bootstrap.inc, as demonstrated using the search box. NOTE: this vulnerability can be leveraged to conduct cross-site request forgery (CSRF) attacks.  
Phase
Assigned (20090506)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
428393 39011 CVE-2009-1576 MISC:http://drupal.org/files/sa-core-2009-005/SA-CORE-2009-005-5.16.patch  View
428394 39011 CVE-2009-1576 CONFIRM:http://drupal.org/node/449078  View
428395 39011 CVE-2009-1576 CONFIRM:http://www.vbdrupal.org/forum/showthread.php?p=9953#post9953  View
428396 39011 CVE-2009-1576 DEBIAN:DSA-1792  View
428397 39011 CVE-2009-1576 URL:http://www.debian.org/security/2009/dsa-1792  View
428398 39011 CVE-2009-1576 FEDORA:FEDORA-2009-4175  View
428399 39011 CVE-2009-1576 URL:https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00108.html  View
428400 39011 CVE-2009-1576 FEDORA:FEDORA-2009-4203  View
428401 39011 CVE-2009-1576 URL:https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00133.html  View
428402 39011 CVE-2009-1576 OSVDB:54153  View
428403 39011 CVE-2009-1576 URL:http://www.osvdb.org/54153  View
428404 39011 CVE-2009-1576 SECUNIA:34948  View
428405 39011 CVE-2009-1576 URL:http://secunia.com/advisories/34948  View
428406 39011 CVE-2009-1576 SECUNIA:34950  View
428407 39011 CVE-2009-1576 URL:http://secunia.com/advisories/34950  View
428408 39011 CVE-2009-1576 SECUNIA:34980  View
428409 39011 CVE-2009-1576 URL:http://secunia.com/advisories/34980  View
428410 39011 CVE-2009-1576 VUPEN:ADV-2009-1216  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
40548 JVNDB-2009-001554 SquirrelMail におけるセッション固定の脆弱性 SquirrelMail には、cookie の処理に不備があるため、セッション固定の脆弱性が存在します。 CVE-2009-1580 39011 6.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001554.html  View