Lucene search

[email protected]CVE-2009-1507

HistoryMay 01, 2009 - 5:30 p.m.

CVE-2009-1507

2009-05-0117:30:00

CWE-264

[email protected]

web.nvd.nist.gov

node access

user reference

drupal

bypass

cve-2009-1507

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.9 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.5%

JSON

The Node Access User Reference module 5.x before 5.x-2.0-beta4 and 6.x before 6.x-2.0-beta6, a module for Drupal, interprets an empty CCK user reference as a reference to the anonymous user, which might allow remote attackers to bypass intended access restrictions to read or modify a node.

Affected configurations

NVD

Node

drupaldrupal

AND

drupalnodeaccess_userreferenceMatch5.x-1.0

drupalnodeaccess_userreferenceMatch5.x-1.1

drupalnodeaccess_userreferenceMatch5.x-1.2

drupalnodeaccess_userreferenceMatch5.x-1.3

drupalnodeaccess_userreferenceMatch5.x-1.4

drupalnodeaccess_userreferenceMatch5.x-2.0beta1

drupalnodeaccess_userreferenceMatch5.x-2.0beta2

drupalnodeaccess_userreferenceMatch5.x-2.0beta3

drupalnodeaccess_userreferenceMatch6.x-1.0

drupalnodeaccess_userreferenceMatch6.x-1.1

drupalnodeaccess_userreferenceMatch6.x-1.2

drupalnodeaccess_userreferenceMatch6.x-1.4

drupalnodeaccess_userreferenceMatch6.x-1.5

drupalnodeaccess_userreferenceMatch6.x-1.6

drupalnodeaccess_userreferenceMatch6.x-1.7

drupalnodeaccess_userreferenceMatch6.x-2.0beta1

drupalnodeaccess_userreferenceMatch6.x-2.0beta2

drupalnodeaccess_userreferenceMatch6.x-2.0beta3

drupalnodeaccess_userreferenceMatch6.x-2.0beta4

drupalnodeaccess_userreferenceMatch6.x-2.0beta5

CPENameOperatorVersion
drupal:nodeaccess_userreferencedrupal nodeaccess userreferenceeq5.x-1.0
drupal:nodeaccess_userreferencedrupal nodeaccess userreferenceeq5.x-1.1
drupal:nodeaccess_userreferencedrupal nodeaccess userreferenceeq5.x-1.2
drupal:nodeaccess_userreferencedrupal nodeaccess userreferenceeq5.x-1.3
drupal:nodeaccess_userreferencedrupal nodeaccess userreferenceeq5.x-1.4
drupal:nodeaccess_userreferencedrupal nodeaccess userreferenceeq5.x-2.0
drupal:nodeaccess_userreferencedrupal nodeaccess userreferenceeq6.x-1.0
drupal:nodeaccess_userreferencedrupal nodeaccess userreferenceeq6.x-1.1
drupal:nodeaccess_userreferencedrupal nodeaccess userreferenceeq6.x-1.2
drupal:nodeaccess_userreferencedrupal nodeaccess userreferenceeq6.x-1.4

CPE	Name	Operator	Version
drupal:nodeaccess_userreference	drupal nodeaccess userreference	eq	5.x-1.0
drupal:nodeaccess_userreference	drupal nodeaccess userreference	eq	5.x-1.1
drupal:nodeaccess_userreference	drupal nodeaccess userreference	eq	5.x-1.2
drupal:nodeaccess_userreference	drupal nodeaccess userreference	eq	5.x-1.3
drupal:nodeaccess_userreference	drupal nodeaccess userreference	eq	5.x-1.4
drupal:nodeaccess_userreference	drupal nodeaccess userreference	eq	5.x-2.0
drupal:nodeaccess_userreference	drupal nodeaccess userreference	eq	6.x-1.0
drupal:nodeaccess_userreference	drupal nodeaccess userreference	eq	6.x-1.1
drupal:nodeaccess_userreference	drupal nodeaccess userreference	eq	6.x-1.2
drupal:nodeaccess_userreference	drupal nodeaccess userreference	eq	6.x-1.4

Rows per page:

1-10 of 141

References

drupal.org/node/449030

secunia.com/advisories/34955

www.securityfocus.com/bid/34778

www.vupen.com/english/advisories/2009/1212

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.9 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.5%

JSON

Related for CVE-2009-1507

prion1 nvd1 cvelist1