« Volver al listado

CVE-2013-4272

Estado: ModificadaMedia (4.3)—

The BOTCHA Spam Prevention module 7.x-1.x before 7.x-1.6, 7.x-2.x before 7.x-2.1, and 7.x-3.x before 7.x-3.3 for Drupal, when the debugging level is set to 5 or 6, logs the content of submitted forms, which allows context-dependent users to obtain sensitive information such as usernames and passwords by reading the log file.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Botcha Spam Prevention Project — Botcha

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-4272",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-08-28T22:55:05.763",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2013/08/22/2",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://drupal.org/node/2064781",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://drupal.org/node/2064783",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://drupal.org/node/2064785",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://drupal.org/node/2065057",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2013/08/22/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://drupal.org/node/2064781",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://drupal.org/node/2064783",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://drupal.org/node/2064785",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://drupal.org/node/2065057",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The BOTCHA Spam Prevention module 7.x-1.x before 7.x-1.6, 7.x-2.x before 7.x-2.1, and 7.x-3.x before 7.x-3.3 for Drupal, when the debugging level is set to 5 or 6, logs the content of submitted forms, which allows context-dependent users to obtain sensitive information such as usernames and passwords by reading the log file."
    },
    {
      "lang": "es",
      "value": "El módulo BOTCHA Spam Prevention v7.x-1.x anterior a v7.x-1.6, v7.x-2.x anterior a v7.x-2.1, y v7.x-3.x anterior a v7.x-3.3 para Drupal, cuando el nivel de depuración se establece en 5 o 6, registra el contenido de los formularios enviados, lo que permite a los usuarios dependientes del contexto obtener información confidencial, como nombres de usuario y las contraseñas mediante la lectura del archivo de registro."
    }
  ],
  "lastModified": "2026-06-16T23:56:55.713",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:botcha_spam_prevention_project:botcha:7.x-1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20D6AC7B-48E7-4E61-87A0-56B30B5E79C1"
            },
            {
              "criteria": "cpe:2.3:a:botcha_spam_prevention_project:botcha:7.x-1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "835D442D-8D23-4A47-9695-51B224B0E8E6"
            },
            {
              "criteria": "cpe:2.3:a:botcha_spam_prevention_project:botcha:7.x-1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2EF34CF-72AB-46D7-8537-FC5A8E73F7BB"
            },
            {
              "criteria": "cpe:2.3:a:botcha_spam_prevention_project:botcha:7.x-1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D94F69C-447A-4352-983D-7C0EF8778F1E"
            },
            {
              "criteria": "cpe:2.3:a:botcha_spam_prevention_project:botcha:7.x-1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B660402-B945-41FD-B821-6BBA332E4585"
            },
            {
              "criteria": "cpe:2.3:a:botcha_spam_prevention_project:botcha:7.x-1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "96668E48-2D12-4FC8-85B4-607E429DE328"
            },
            {
              "criteria": "cpe:2.3:a:botcha_spam_prevention_project:botcha:7.x-1.x:dev:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C337A5E-BB87-4BB8-B52A-1225FDCE07E2"
            },
            {
              "criteria": "cpe:2.3:a:botcha_spam_prevention_project:botcha:7.x-2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8889659A-063E-4148-8CF5-0799DE923766"
            },
            {
              "criteria": "cpe:2.3:a:botcha_spam_prevention_project:botcha:7.x-2.x:dev:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "378D5013-6326-400F-B174-F47B9F33A0B7"
            },
            {
              "criteria": "cpe:2.3:a:botcha_spam_prevention_project:botcha:7.x-3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E0FB36A-37B6-41C9-9263-7D3E37AC260E"
            },
            {
              "criteria": "cpe:2.3:a:botcha_spam_prevention_project:botcha:7.x-3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80BDF06F-901A-47E3-BC24-71E287E12405"
            },
            {
              "criteria": "cpe:2.3:a:botcha_spam_prevention_project:botcha:7.x-3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C3CC7B7-109A-4F06-8DCC-B5DF7E9184FD"
            },
            {
              "criteria": "cpe:2.3:a:botcha_spam_prevention_project:botcha:7.x-3.x:dev:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8594107-7728-4D2D-A85E-358D960843E3"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F8B1170D-AD33-4C7A-892D-63AC71B032CF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}