CVEvulnerability
CVE-2015-5502
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2015-08-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-284
Description
The Storage API module 7.x-1.x before 7.x-1.8 for Drupal does not properly restrict access to Storage API fields attached to entities that are not nodes, which allows remote attackers to have unspecified impact via unknown vectors.
Affected configurations
• storage api project storage api 7.x-1.0
• storage api project storage api 7.x-1.1
• storage api project storage api 7.x-1.2
• storage api project storage api 7.x-1.3
• storage api project storage api 7.x-1.4
• storage api project storage api 7.x-1.5
• storage api project storage api 7.x-1.6
• storage api project storage api 7.x-1.7
Related
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- http://www.openwall.com/lists/oss-security/2015/07/04/4 www.openwall.com
- http://www.securityfocus.com/bid/74867 www.securityfocus.com
- https://www.drupal.org/node/2495895 Patch
- https://www.drupal.org/node/2495903 Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2015/07/04/4 www.openwall.com
- http://www.securityfocus.com/bid/74867 www.securityfocus.com
- https://www.drupal.org/node/2495895 Patch
- https://www.drupal.org/node/2495903 Patch, Vendor Advisory