Detections
Analytics
Drupal 6.x < 6.34 / 7.x < 7.34 Multiple Vulnerabilities
medium Nessus Plugin ID 79386
Language:
Synopsis
The remote web server is running a PHP application that is affected by multiple vulnerabilities.Description
The remote web server is running a version of Drupal that is 6.x prior to 6.34 or 7.x prior to 7.34. It is, therefore, potentially affected by the following vulnerabilities :- There exists an unspecified flaw that is triggered when handling a specially crafted request that may allow a remote attacker to perform a session hijacking attack.
(CVE-2014-9015)
- There exists a flaw in the password hashing API that is triggered when handling a specially crafted request. An attacker may use this to consume resources and cause a denial of service. This issue is only present in versions of Drupal prior to 7.34. (CVE-2014-9016)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to version 6.34 / 7.34 or later.See Also
https://www.drupal.org/SA-CORE-2014-006
Plugin Details
Severity: Medium
ID: 79386
File Name: drupal_7_34.nasl
Version: 1.13
Type: remote
Family: CGI abuses
Published: 11/21/2014
Updated: 4/11/2022
Configuration: Enable paranoid mode, Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/a:drupal:drupal
Required KB Items: www/PHP, installed_sw/Drupal, Settings/ParanoidReport
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/19/2014
Vulnerability Publication Date: 11/19/2014
Reference Information
CVE: CVE-2014-9015, CVE-2014-9016