Vulnerability Name: | CVE-2010-1548 (CCN-58724) | ||||||||
Assigned: | 2010-05-20 | ||||||||
Published: | 2010-05-20 | ||||||||
Updated: | 2017-08-17 | ||||||||
Summary: | The auto-complete functionality in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal does not follow access restrictions, which allows remote authenticated users, with "access content" privileges, to read the title of an unpublished node via a q=ctools/autocomplete/node/ value accompanied by the first character of the node's title. | ||||||||
CVSS v3 Severity: | 3.5 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)
| ||||||||
CVSS v2 Severity: | 3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N) 2.6 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)
3.0 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N/E:U/RL:OF/RC:C)
| ||||||||
Vulnerability Type: | CWE-264 | ||||||||
Vulnerability Consequences: | Bypass Security | ||||||||
References: | Source: MITRE Type: CNA CVE-2010-1548 Source: CCN Type: SA-CONTRIB-2010-058 Chaos tool suite - Multiple vulnerabilities Source: CONFIRM Type: Patch, Vendor Advisory http://drupal.org/node/803944 Source: FULLDISC Type: UNKNOWN 20100520 Drupal Chaos Tools Suite (Ctools) Module Multiple Vulns Source: CCN Type: SA39884 Drupal Chaos Tool Suite Module Multiple Vulnerabilities Source: SECUNIA Type: Vendor Advisory 39884 Source: MISC Type: UNKNOWN http://www.madirish.net/?article=458 Source: CCN Type: OSVDB ID: 64767 Chaos Tool Suite Module for Drupal ctools/autocomplete/node URI Access Restrictions Bypass Source: BID Type: Patch 40285 Source: CCN Type: BID-40285 Drupal Chaos Tool Suite Module Multiple Remote Vulnerabilities Source: XF Type: UNKNOWN chaos-tool-permissions-sec-bypass(58724) Source: XF Type: UNKNOWN chaos-tool-permissions-sec-bypass(58724) | ||||||||
Vulnerable Configuration: | Configuration 1:![]() | ||||||||
BACK |