Description

Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.

Remediation

References

CVE-2012-0825

Related Vulnerabilities

Oracle Database Server CVE-2020-2734 Vulnerability (CVE-2020-2734)

WordPress Plugin Easy Forms for MailChimp Unspecified Vulnerability (6.0.3.2)

Apache Traffic Server CVE-2023-30631 Vulnerability (CVE-2023-30631)

WordPress Plugin Disable Comments Cross-Site Request Forgery (1.0.3)

Dolphin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-27969)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2012-0825