CVE-2012-4486

boombatower subuser < 6.x-1.7 - Cross-Site Request Forgery via Subuser Switch

Title source: llm

Description

Cross-site request forgery (CSRF) vulnerability in the Subuser module before 6.x-1.8 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that switch the user to a subuser via unspecified vectors.

References (4)

Core 4

Core References

Mailing List mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2012/10/04/6

Patch, Vendor Advisory x_refsource_misc

http://drupal.org/node/1700584

Patch x_refsource_confirm

http://drupal.org/node/1700550

Mailing List mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2012/10/07/1

Scores

EPSS 0.0064

EPSS Percentile 46.5%

Details

CWE

CWE-352

Status published

Products (9)

boombatower/subuser 6.x-1.0

boombatower/subuser 6.x-1.1

boombatower/subuser 6.x-1.2

boombatower/subuser 6.x-1.3

boombatower/subuser 6.x-1.4

boombatower/subuser 6.x-1.5

boombatower/subuser 6.x-1.6

boombatower/subuser 6.x-1.x dev

boombatower/subuser < 6.x-1.7

Published Nov 02, 2012

Tracked Since Feb 18, 2026