NVD

Id
6640  
Name
CVE-2008-6909  
Description
Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not sign all required data in requests, which has unspecified impact, probably related to man-in-the-middle attacks that modify critical data and allow remote attackers to impersonate other users and gain privileges.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2009-08-06  
Modified Date
2009-08-19  
Seq
2008-6909  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
38193 6640 CVE-2008-6909 http://drupal.org/node/348295  View
38194 6640 CVE-2008-6909 32894  View
38195 6640 CVE-2008-6909 services-insecure-hash-weak-security(47458)  View
38196 6640 CVE-2008-6909 services-request-security-bypass(52438)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
49933 JVNDB-2008-005243 Drupal 用の Services モジュールにおける権限を取得される脆弱性 Drupal 用の Services モジュールには、リクエスト内の全必須データを署名しないため、中間者攻撃による重要データを改ざんされる、他のユーザになりすまされる、および権限を取得されるなど、不特定の影響を受ける脆弱性が存在します。 CVE-2008-6909 37022 CVE-2008-6909 6640 6.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-005243.html 2008-12-17 2012-09-25 View