Re: CVE request for Drupal contributed modules

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Hi there, I'd like to request CVE identifiers for:
>
> SA-CONTRIB-2013-098 - Ubercart - Session Fixation Vulnerability
> https://drupal.org/node/2158651

Use CVE-2013-7302. The advisory says "attacker must have access to the
original session ID of the victim." Do you know whether the relevant
attacks occur at times when this original session ID is invalid?


> SA-CONTRIB-2014-001 - Entity API - Access Bypass
> https://drupal.org/node/2169595

This file already has CVE identifiers.


> SA-CONTRIB-2014-002 - Anonymous Posting - Cross Site Scripting (XSS)
> https://drupal.org/node/2173321

Use CVE-2014-1611.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJS3U4rAAoJEKllVAevmvms/7cH/i58BA1NhJhsoyjo3zKSycwt
uPDk9TT2mW7OTamRD/GNnx7MdIMD4noiu37Hdl9fCenDovZDFo73Lr1mQkMQpLrh
DSvyt3TSQ5PSxGnv3e3KbK5Gj2FNyYSkaQ3tenhZJ7mL4/gXgAoZJs3LEXD8uwc9
Jl5gvcRJ0Zy0UOC7OavQoi+nvvOeqbY2FlyA4zAL9uZbNL5zOx5kiKLUdDXOYv44
3HjGQwvr9Aek9nC2Rvs9B3ETxPjNP/gIXQCDjWZF1cAm1Kof4+t7jXmqjJsyscQB
GGWnAy6ps1E+7pTAPOC5eWiwPuOrqaVK/h6JyP7IW5aPS4v0qMYu+jaXQFz4mac=
=c31C
-----END PGP SIGNATURE-----