CVE-2009-4044: High severity bruno massa web services vulnerability
Published Nov 20, 2009
·Updated
The Web Services module 6.x for Drupal does not perform the expected access control, which allows remote attackers to make unspecified use of an API via unknown vectors.
Affected Software
2 affected components
Bruno Massa Web Services=6.x-1.0
Drupal Drupal
Event History
Nov 20, 2009
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Data Sourced
07:30 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is remotely exploitable without authentication. The provided vector indicates network access with low attack complexity and no credentials required.
2
What security impact could successful exploitation have?
Successful exploitation may affect confidentiality, integrity, and availability, as reflected by the CVSS vector. The specific API actions available to an attacker are not identified in the provided data.
3
Is the default configuration affected?
The available information does not state whether the vulnerable API is enabled or exposed by default. Exposure depends on use of the Web Services module 6.x and its API configuration.