CVE-2009-2374

Publication date 8 July 2009

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Description

Drupal 5.x before 5.19 and 6.x before 6.13 does not properly sanitize failed login attempts for pages that contain a sortable table, which includes the username and password in links that can be read from (1) the HTTP referer header of external web sites that are visited from those links or (2) when page caching is enabled, the Drupal page cache.

Read the notes from the security team

Status

Package Ubuntu Release Status
drupal5 9.10 karmic
Not affected
9.04 jaunty
Fixed 5.15-1ubuntu1.1
8.10 intrepid
Fixed 5.10-1ubuntu1.1
8.04 LTS hardy
Fixed 5.7-1ubuntu1.2
6.06 LTS dapper Not in release
drupal6 9.10 karmic
Not affected
9.04 jaunty
Fixed 6.10-1ubuntu0.1
8.10 intrepid Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release

Notes

mdeslaur

SA-CORE-2009-007

References

Other references