Description

Drupal Core is prone to a denial of service vulnerability. Exploiting this issue may allow an attacker to cause the affected website to consume memory and CPU resources or to fill up the server disk space, thus denying service to legitimate users. Drupal Core versions 7.x ranging from 7.0 and up to and including 7.19 are vulnerable.

Remediation

Update to Drupal Core version 7.20 or latest

References

http://berk.es/2013/03/04/drupal-imagecache-security-vulnarability-with-ddos-attack-explained/

https://www.drupal.org/SA-CORE-2013-002

Related Vulnerabilities

WordPress Plugin WP Photo Album Plus Unspecified Vulnerability (6.5.00)

WordPress Plugin Ultimate GDPR & CCPA Compliance Toolkit for WordPress Security Bypass (2.4)

MongoDb Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-6494)

WordPress Plugin Export Users to CSV CSV Injection (1.4.2)

WordPress Plugin ARPrice-Responsive Pricing Table Cross-Site Scripting (2.2)

Severity

High

Classification

CVE-2013-0316 CWE-400 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update Denial Of Service