Vulnerabilities > CVE-2012-2067 - Remote Security vulnerability in Fckeditor
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Unspecified vulnerability in the CKeditor module 6.x-2.x before 6.x-2.3 and the CKEditor module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.7 for Drupal, when the core PHP module is enabled, allows remote authenticated users or remote attackers to execute arbitrary PHP code via the text parameter to a text filter. NOTE: some of these details are obtained from third party information. Per http://drupal.org/node/1482528 the versions affected are "FCKeditor 6.x-2.x versions prior to 6.x-2.3, CKEditor 6.x-1.x versions prior to 6.x-1.9, and CKEditor 7.x-1.x versions prior to 7.x-1.7."
Vulnerable Configurations
References
- http://drupal.org/node/1482442
- http://drupal.org/node/1482466
- http://drupal.org/node/1482480
- http://drupal.org/node/1482528
- http://secunia.com/advisories/48435
- http://www.openwall.com/lists/oss-security/2012/04/07/1
- http://www.osvdb.org/80080
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74037