medium6.8
CVE-2012-0825
Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentia…
Impact
Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Drupal | Drupal | Versions 6.0, 6.1, 6.2, 6.10, 6.11, 6.12 |
Weakness classification
References
- NVD record
- CVE.org record
- http://openid.net/2011/05/05/attribute-exchange-security-alert/
- http://www.debian.org/security/2013/dsa-2776
- https://drupal.org/node/1425084
- http://openid.net/2011/05/05/attribute-exchange-security-alert/
- http://www.debian.org/security/2013/dsa-2776
- https://drupal.org/node/1425084