« Volver al listado

CVE-2008-6910

Estado: ModificadaAlta (7.5)—

Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not use timeouts for signed requests, which allows remote attackers to impersonate other users and gain privileges via a replay attack that sends the same request.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Marc Ingram — Services

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-6910",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-08-06T18:30:00.233",
  "references": [
    {
      "url": "http://drupal.org/node/348295",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/50743",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/32894",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52441",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/348295",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/50743",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/32894",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52441",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not use timeouts for signed requests, which allows remote attackers to impersonate other users and gain privileges via a replay attack that sends the same request."
    },
    {
      "lang": "es",
      "value": "El Modulo Services v5.x anterior a v5.x-0.92 y v6.x anterior a v6.x-0.13 para Drupal,  no emplea tiempos de espera para las peticiones firmadas, lo que permite a atacantes remotos suplantar a otros usuarios y obtener privilegios a través de un ataque de reproducción que envía la misma petición."
    }
  ],
  "lastModified": "2026-06-16T23:03:13.073",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:marc_ingram:services:5.x-0.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "971DC8A9-7356-4D6F-993C-5F5F28EF037D"
            },
            {
              "criteria": "cpe:2.3:a:marc_ingram:services:5.x-0.91:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E589A651-CBBB-49E5-8D67-68DBE6159570"
            },
            {
              "criteria": "cpe:2.3:a:marc_ingram:services:5.x-1.x-dev:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCF5BAF1-3FF5-4D36-8B18-0C1DA07C4344"
            },
            {
              "criteria": "cpe:2.3:a:marc_ingram:services:6.x-0.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B403152-7E41-43D5-A71D-1FFBCD99C334"
            },
            {
              "criteria": "cpe:2.3:a:marc_ingram:services:6.x-0.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47E13993-D2EE-40AD-98E2-EC5B76589970"
            },
            {
              "criteria": "cpe:2.3:a:marc_ingram:services:6.x-0.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EBF94F5E-8314-436F-8259-0190E32586A3"
            },
            {
              "criteria": "cpe:2.3:a:marc_ingram:services:6.x-1.x-dev:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4307E56C-E735-416C-B170-225609059BEE"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}