CVE-2008-6908: High severity marc ingram services vulnerability
Published Aug 6, 2009
·Updated
Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, uses an insecure hash when signing requests, which allows remote attackers to impersonate other users and gain privileges.
Affected Software
8 affected components
Marc Ingram Services=5.x-0.9
Marc Ingram Services=5.x-0.91
Marc Ingram Services=5.x-1.x-dev
Marc Ingram Services=6.x-0.9
Marc Ingram Services=6.x-0.11
Marc Ingram Services=6.x-0.12
Marc Ingram Services=6.x-1.x-dev
Drupal Drupal
Remediation
Patch Available
Patch Available
Event History
Aug 6, 2009
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
05:30 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2008-6908?
CVE-2008-6908 has been classified as a high severity vulnerability due to its potential to allow remote attackers to impersonate users.
2
How do I fix CVE-2008-6908?
To fix CVE-2008-6908, upgrade to Services module version 5.x-0.92 or 6.x-0.13 or later.
3
What versions are affected by CVE-2008-6908?
CVE-2008-6908 affects Services versions 5.x before 5.x-0.92 and 6.x before 6.x-0.13.
4
What type of attack can CVE-2008-6908 facilitate?
CVE-2008-6908 facilitates user impersonation attacks allowing unauthorized privilege escalation.
5
Is CVE-2008-6908 related to Drupal security?
Yes, CVE-2008-6908 is a security vulnerability within the Services module for Drupal.