CVE-2012-5549

Published: Dec 3, 2012Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Cross-site request forgery (CSRF) vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

Affected (2)

Products: Carlos Carvalhar: Time Spent

Carlos Carvalhar

1 product

Time Spent

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Carlos Carvalhar Time Spent	Version 6.x-2.x
Carlos Carvalhar Time Spent	Version 7.x-2.x

Running on/with	Platform Versions
Drupal Drupal	All versions

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (4)

http://drupal.org/node/1822066

Source: secalert@redhat.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2012/11/20/4

Source: secalert@redhat.com

http://drupal.org/node/1822066

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.openwall.com/lists/oss-security/2012/11/20/4

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.