CVEvulnerability
CVE-2015-4375
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-06-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an autocomplete search on custom entities without an access query tag or (2) leveraging knowledge of the ID of an entity.
Affected configurations
• chaos tool suite project ctools 7.x-1.0
• chaos tool suite project ctools 7.x-1.1
• chaos tool suite project ctools 7.x-1.2
• chaos tool suite project ctools 7.x-1.3
• chaos tool suite project ctools 7.x-1.4
• chaos tool suite project ctools 7.x-1.5
• chaos tool suite project ctools 7.x-1.6
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://www.openwall.com/lists/oss-security/2015/03/22/35 www.openwall.com
- http://www.openwall.com/lists/oss-security/2015/04/25/6 www.openwall.com
- https://www.drupal.org/node/2454883 Patch
- https://www.drupal.org/node/2454909 Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2015/03/22/35 www.openwall.com
- http://www.openwall.com/lists/oss-security/2015/04/25/6 www.openwall.com
- https://www.drupal.org/node/2454883 Patch
- https://www.drupal.org/node/2454909 Patch, Vendor Advisory