CVE-2008-6910

Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not use timeouts for signed requests, which allows remote attackers to impersonate other users and gain privileges via a replay attack that sends the same request.

Score

CVSS 2.0 7.5 High

Status

Modified - cve@mitre.org

Published

2009-08-06

Last modified

2024-08-07

Weaknesses

CWE-310

Affected products

• Services (Marc Ingram)

References

• http://drupal.org/node/348295
• http://osvdb.org/50743
• http://www.securityfocus.com/bid/32894
• https://exchange.xforce.ibmcloud.com/vulnerabilities/52441