CVE-2012-3798 — MEDIUM (5.0)

Vulnerability Description

The Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when creating a local user account, allows attackers to obtain part of the initial input used to generate passwords, which makes it easier to conduct brute force password guessing attacks.

CVSS Score

5.0

MEDIUM

AV:N/AC:L/Au:N/C:P/I:N/A:N

Confidentiality

PARTIAL

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Bryce Hamrick	Janrain Capture	6.x-1.0
Drupal	Drupal	-

Related Weaknesses (CWE)

CWE-200

References

http://drupal.org/node/1632702Patch
http://drupal.org/node/1632704Patch
http://drupal.org/node/1632734PatchVendor Advisory
http://osvdb.org/82957
http://drupal.org/node/1632702Patch
http://drupal.org/node/1632704Patch
http://drupal.org/node/1632734PatchVendor Advisory
http://osvdb.org/82957

FAQ

What is CVE-2012-3798?

CVE-2012-3798 is a vulnerability with a CVSS score of 5.0 (MEDIUM). The Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when creating a local user account, allows attackers to obtain part of the initial input used to generate passwords, which makes it easier to...

How severe is CVE-2012-3798?

CVE-2012-3798 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2012-3798?

Check the references section above for vendor advisories and patch information. Affected products include: Bryce Hamrick Janrain Capture, Drupal Drupal.