CVE-2012-1633: CSRF
Published Sep 20, 2012
·Updated
Cross-site request forgery (CSRF) vulnerability in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote attackers to hijack the authentication of administrative users for requests that unblock a user.
Affected Software
10 affected components
Erikwebb Password Policy=6.x-1.0
Erikwebb Password Policy=6.x-1.0-alpha2
Erikwebb Password Policy=6.x-1.0-alpha3
Erikwebb Password Policy=6.x-1.0-alpha4
Erikwebb Password Policy=6.x-1.0-beta1
Erikwebb Password Policy=6.x-1.1
Erikwebb Password Policy=6.x-1.2
Erikwebb Password Policy=6.x-1.3
Erikwebb Password Policy=7.x-1.0-beta3
Drupal Drupal
Event History
Sep 20, 2012
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-1633?
The severity of CVE-2012-1633 is classified as moderate due to the potential for administrative user authentication hijacking.
2
How do I fix CVE-2012-1633?
To fix CVE-2012-1633, update the Password Policy module to version 6.x-1.4 or 7.x-1.0 beta4 or later.
3
Which versions are affected by CVE-2012-1633?
CVE-2012-1633 affects the Password Policy module versions prior to 6.x-1.4 and 7.x-1.0 beta4.
4
What type of vulnerability is CVE-2012-1633?
CVE-2012-1633 is a Cross-site request forgery (CSRF) vulnerability.
5
Can CVE-2012-1633 be exploited remotely?
Yes, CVE-2012-1633 can be exploited remotely by attackers to hijack the authentication of administrative users.