NVD

Id
31645  
Name
CVE-2014-3453  
Description
Eval injection vulnerability in the flag_import_form_validate function in includes/flag.export.inc in the Flag module 7.x-3.0, 7.x-3.5, and earlier for Drupal allows remote authenticated administrators to execute arbitrary PHP code via the "Flag import code" text area to admin/structure/flags/import. NOTE: this issue could also be exploited by other attackers if the administrator ignores a security warning on the permissions assignment page.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-05-17  
Modified Date
2014-05-19  
Seq
2014-3453  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
165713 31645 CVE-2014-3453 20140509 Drupal Flag 7.x-3.5 Module Vulnerability report: Arbitrary code execution due to improper input handling in flag importer  View
165714 31645 CVE-2014-3453 [oss-security] 20140512 Re: CVE request: Drupal Flag 7.x-3.5 Module Vulnerability report: Arbitrary code execution due to improper input handling in flag importer  View
165715 31645 CVE-2014-3453 67318  View
165716 31645 CVE-2014-3453 https://bugzilla.redhat.com/show_bug.cgi?id=1096604  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
13664 JVNDB-2014-002539 Drupal 用 Flag モジュールの includes/flag.export.inc の flag_import_form_validate 関数における任意の PHP コードを実行される脆弱性 Drupal 用 Flag モジュールの includes/flag.export.inc の flag_import_form_validate 関数には、Eval インジェクションにより、任意の PHP コードを実行される脆弱性が存在します。 CVE-2014-3453 70741 CVE-2014-3453 31645 6.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002539.html 2014-05-12 2014-05-20 View