Description

Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.

Remediation

References

CVE-2012-0825

Related Vulnerabilities

WordPress Plugin Ninja Forms Contact Form-The Drag and Drop Form Builder for WordPress Cross-Site Scripting (3.2.13)

MongoDb Improper Input Validation Vulnerability (CVE-2014-3971)

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-5625)

Oracle Application Server CVE-2008-3977 Vulnerability (CVE-2008-3977)

WordPress Plugin WordPress Responsive Preview Cross-Site Scripting (1.1)

Severity

Medium

Classification

CVE-2012-0825 CWE-200

Tags

Missing Update Known Vulnerabilities