CVE-2006-5476

Cross-site request forgery (CSRF) vulnerability in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allows remote attackers to perform unauthorized actions as an arbitrary user via unspecified vectors.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://drupal.org/node/88828
http://secunia.com/advisories/22486	Vendor Advisory
http://securityreason.com/securityalert/1765
http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.025-drupal.html
http://www.securityfocus.com/archive/1/449199/100/0/threaded
http://www.vupen.com/english/advisories/2006/4120
https://exchange.xforce.ibmcloud.com/vulnerabilities/29679

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:drupal:drupal:4.6.0:::::::*
	cpe:2.3:a:drupal:drupal:4.6.1:::::::*
	cpe:2.3:a:drupal:drupal:4.6.2:::::::*
	cpe:2.3:a:drupal:drupal:4.6.3:::::::*
	cpe:2.3:a:drupal:drupal:4.6.4:::::::*
	cpe:2.3:a:drupal:drupal:4.6.5:::::::*
	cpe:2.3:a:drupal:drupal:4.6.6:::::::*
	cpe:2.3:a:drupal:drupal:4.6.7:::::::*
	cpe:2.3:a:drupal:drupal:4.6.8:::::::*
	cpe:2.3:a:drupal:drupal:4.6.9:::::::*
	cpe:2.3:a:drupal:drupal:4.7.0:::::::*
	cpe:2.3:a:drupal:drupal:4.7.1:::::::*
	cpe:2.3:a:drupal:drupal:4.7.2:::::::*
	cpe:2.3:a:drupal:drupal:4.7.3:::::::*

History

No history.

Information

Published : 2006-10-24 20:07

Updated : 2024-02-28 11:01

NVD link : CVE-2006-5476

Mitre link : CVE-2006-5476

CVE.ORG link : CVE-2006-5476

JSON object : View

Products Affected

drupal

drupal

CWE

NVD-CWE-Other

{"id": "CVE-2006-5476", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-10-24T20:07:00.000", "references": [{"url": "http://drupal.org/node/88828", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/22486", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/1765", "source": "cve@mitre.org"}, {"url": "http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.025-drupal.html", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/449199/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/4120", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29679", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Cross-site request forgery (CSRF) vulnerability in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allows remote attackers to perform unauthorized actions as an arbitrary user via unspecified vectors."}, {"lang": "es", "value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados en Drupal 4.6.x anterior a 4.6.10 y 4.7.x anterior a 4.7.4 permite a atacantes remotos llevar a cabo acciones no autorizadas como usuario de su elecci\u00f3n mediante vectores no especificados."}], "lastModified": "2018-10-17T21:43:30.847", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:4.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95DA206C-EF72-4379-9ED8-795FCAD0BE19"}, {"criteria": "cpe:2.3:a:drupal:drupal:4.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC5ACB7E-0CEB-4417-839A-8B06615FC981"}, {"criteria": "cpe:2.3:a:drupal:drupal:4.6.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35BD7D35-AA9D-4589-A6BC-6D34219B7128"}, {"criteria": "cpe:2.3:a:drupal:drupal:4.6.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "611B9D43-CE88-4451-A27C-7F6F24016B4F"}, {"criteria": "cpe:2.3:a:drupal:drupal:4.6.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD1A7208-6273-4CC6-AB7B-DA855EEF2729"}, {"criteria": "cpe:2.3:a:drupal:drupal:4.6.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83457EB5-BA6B-4ECB-8CB2-A10989B3A9F9"}, {"criteria": "cpe:2.3:a:drupal:drupal:4.6.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49A92C9C-18DD-4FF7-A95D-72EE72C83C0E"}, {"criteria": "cpe:2.3:a:drupal:drupal:4.6.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3DC016B5-A4C2-4A78-B830-C041C8BAAD76"}, {"criteria": "cpe:2.3:a:drupal:drupal:4.6.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35B99C22-9A8C-43F3-9AD8-D901D07D5FCD"}, {"criteria": "cpe:2.3:a:drupal:drupal:4.6.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB94DAC5-F0E1-4427-98E4-A5684BF3F408"}, {"criteria": "cpe:2.3:a:drupal:drupal:4.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94D0FD99-066F-4161-9524-01DD01F31527"}, {"criteria": "cpe:2.3:a:drupal:drupal:4.7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79F8FEEF-6857-4DC8-9D0D-76D801D0E914"}, {"criteria": "cpe:2.3:a:drupal:drupal:4.7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61EC4ECE-6719-4C54-B150-017ACB32E644"}, {"criteria": "cpe:2.3:a:drupal:drupal:4.7.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D5368BD-60AC-49E7-80D4-A5B317319A31"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}