Description

Drupal Core is prone to a denial of service vulnerability. Exploiting this issue may allow an attacker to cause the affected website to consume memory and CPU resources or to fill up the server disk space, thus denying service to legitimate users. Drupal Core versions 7.x ranging from 7.0 and up to and including 7.19 are vulnerable.

Remediation

Update to Drupal Core version 7.20 or latest

References

http://berk.es/2013/03/04/drupal-imagecache-security-vulnarability-with-ddos-attack-explained/

https://www.drupal.org/SA-CORE-2013-002

Related Vulnerabilities

TYPO3 Uncontrolled Recursion Vulnerability (CVE-2022-23500)

WordPress Plugin JSON API Open Redirect (1.1.3)

WordPress Plugin WooCommerce Privilege Escalation (3.5.0)

Apache Traffic Server Improper Input Validation Vulnerability (CVE-2022-31780)

WordPress Plugin Newsletters Multiple Vulnerabilities (4.6.5.3)

Severity

High

Classification

CVE-2013-0316 CWE-400 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update Denial Of Service