CVEvulnerability
CVE-2010-2353
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-06-21
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-264
Description
The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes.
Affected configurations
• yves chedemois cck 6.x-1.0-alpha
• yves chedemois cck 6.x-1.x-dev
• yves chedemois cck 6.x-2.0
• yves chedemois cck 6.x-2.1
• yves chedemois cck 6.x-2.2
• yves chedemois cck 6.x-2.3
• yves chedemois cck 6.x-2.4
• yves chedemois cck 6.x-2.5
• yves chedemois cck 6.x-2.6
• yves chedemois cck 6.x-2.x-dev
• yves chedemois cck 6.x-3.x-dev
Related
Weakness · not in database (1)
References
- http://drupal.org/node/829566 Patch
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html lists.fedoraproject.org
- http://osvdb.org/65615 osvdb.org
- http://secunia.com/advisories/40243 Vendor Advisory
- http://secunia.com/advisories/40318 secunia.com
- http://www.vupen.com/english/advisories/2010/1546 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59515 exchange.xforce.ibmcloud.com
- http://drupal.org/node/829566 Patch
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html lists.fedoraproject.org
- http://osvdb.org/65615 osvdb.org
- http://secunia.com/advisories/40243 Vendor Advisory
- http://secunia.com/advisories/40318 secunia.com
- http://www.vupen.com/english/advisories/2010/1546 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59515 exchange.xforce.ibmcloud.com