CVEvulnerability
CVE-2015-7229
3.5 LOW
Official page ↗
- Status
- Modified
- Published
- 2015-09-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-264
Description
The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the (1) "post to twitter" permission or change the options for arbitrary attached accounts by leveraging the (2) "add twitter accounts" or (3) "add authenticated twitter accounts" permission.
Affected configurations
• twitter project twitter 6.x-5.0
• twitter project twitter 6.x-5.1
• twitter project twitter 6.x-5.x
• twitter project twitter 7.x-5.0
• twitter project twitter 7.x-5.1
• twitter project twitter 7.x-5.2
• twitter project twitter 7.x-5.3
• twitter project twitter 7.x-5.4
• twitter project twitter 7.x-5.5
• twitter project twitter 7.x-5.6
• twitter project twitter 7.x-5.7
• twitter project twitter 7.x-5.8
• twitter project twitter 7.x-6.0
Related
Weakness · not in database (1)
References
- https://www.drupal.org/node/2559981 Patch
- https://www.drupal.org/node/2559985 Patch
- https://www.drupal.org/node/2559989 Patch
- https://www.drupal.org/node/2565827 Patch, Vendor Advisory
- https://www.drupal.org/node/2559981 Patch
- https://www.drupal.org/node/2559985 Patch
- https://www.drupal.org/node/2559989 Patch
- https://www.drupal.org/node/2565827 Patch, Vendor Advisory