Detections
Analytics
Site Documentation Module for Drupal Database Tables Access Content Permission Information Disclosure
high Nessus Plugin ID 32325
Language:
Synopsis
The remote web server contains a PHP application that is affected by an information disclosure vulnerability.Description
The version of the Site Documentation third-party module for Drupal installed on the remote host allows any user with 'access content' permission to retrieve the contents of arbitrary tables in the application's database. An attacker can exploit this issue to retrieve sensitive information, such as usernames, password hashes, email addresses, and active SESSION IDs.Solution
Upgrade to Site Documentation 5.x-1.8 / 6.x-1.1 or later.See Also
Plugin Details
Severity: High
ID: 32325
File Name: drupal_sitedoc_tables_disclosure.nasl
Version: 1.23
Type: remote
Family: CGI abuses
Published: 5/16/2008
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:drupal:drupal, cpe:/a:drupal:site_documentation_module
Required KB Items: installed_sw/Drupal, www/PHP
Exploit Ease: No known exploits are available
Patch Publication Date: 5/14/2008
Vulnerability Publication Date: 5/14/2008
Reference Information
CVE: CVE-2008-2271
BID: 29242