Lucene search

MitreCVE-2010-1548

HistoryMay 21, 2010 - 8:30 p.m.

CVE-2010-1548

2010-05-2120:30:01

CWE-264

mitre

web.nvd.nist.gov

cve-2010-1548

drupal

ctools

access restrictions

auto-complete

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

0.002

Percentile

56.6%

JSON

The auto-complete functionality in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal does not follow access restrictions, which allows remote authenticated users, with “access content” privileges, to read the title of an unpublished node via a q=ctools/autocomplete/node/ value accompanied by the first character of the node’s title.

Affected configurations

Nvd

Node

chaos_tool_suite_projectctoolsMatch6.x-1.0drupal

chaos_tool_suite_projectctoolsMatch6.x-1.0alpha1drupal

chaos_tool_suite_projectctoolsMatch6.x-1.0alpha2drupal

chaos_tool_suite_projectctoolsMatch6.x-1.0alpha3drupal

chaos_tool_suite_projectctoolsMatch6.x-1.0beta1drupal

chaos_tool_suite_projectctoolsMatch6.x-1.0beta2drupal

chaos_tool_suite_projectctoolsMatch6.x-1.0beta3drupal

chaos_tool_suite_projectctoolsMatch6.x-1.0beta4drupal

chaos_tool_suite_projectctoolsMatch6.x-1.0rc1drupal

chaos_tool_suite_projectctoolsMatch6.x-1.1drupal

chaos_tool_suite_projectctoolsMatch6.x-1.2drupal

chaos_tool_suite_projectctoolsMatch6.x-1.3drupal

chaos_tool_suite_projectctoolsMatch6.x-1.xdevdrupal

VendorProductVersionCPE
chaos_tool_suite_projectctools6.x-1.0cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:*:*:*:*:drupal:*:*
chaos_tool_suite_projectctools6.x-1.0cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:alpha1:*:*:*:drupal:*:*
chaos_tool_suite_projectctools6.x-1.0cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:alpha2:*:*:*:drupal:*:*
chaos_tool_suite_projectctools6.x-1.0cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:alpha3:*:*:*:drupal:*:*
chaos_tool_suite_projectctools6.x-1.0cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:beta1:*:*:*:drupal:*:*
chaos_tool_suite_projectctools6.x-1.0cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:beta2:*:*:*:drupal:*:*
chaos_tool_suite_projectctools6.x-1.0cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:beta3:*:*:*:drupal:*:*
chaos_tool_suite_projectctools6.x-1.0cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:beta4:*:*:*:drupal:*:*
chaos_tool_suite_projectctools6.x-1.0cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:rc1:*:*:*:drupal:*:*
chaos_tool_suite_projectctools6.x-1.1cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.1:*:*:*:*:drupal:*:*

Vendor	Product	Version	CPE
chaos_tool_suite_project	ctools	6.x-1.0	cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:::::drupal::
chaos_tool_suite_project	ctools	6.x-1.0	cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:alpha1::::drupal::*
chaos_tool_suite_project	ctools	6.x-1.0	cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:alpha2::::drupal::*
chaos_tool_suite_project	ctools	6.x-1.0	cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:alpha3::::drupal::*
chaos_tool_suite_project	ctools	6.x-1.0	cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:beta1::::drupal::*
chaos_tool_suite_project	ctools	6.x-1.0	cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:beta2::::drupal::*
chaos_tool_suite_project	ctools	6.x-1.0	cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:beta3::::drupal::*
chaos_tool_suite_project	ctools	6.x-1.0	cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:beta4::::drupal::*
chaos_tool_suite_project	ctools	6.x-1.0	cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.0:rc1::::drupal::*
chaos_tool_suite_project	ctools	6.x-1.1	cpe:2.3:a:chaos_tool_suite_project:ctools:6.x-1.1:::::drupal::

Rows per page:

1-10 of 131

References

drupal.org/node/803944

seclists.org/fulldisclosure/2010/May/272

secunia.com/advisories/39884

www.madirish.net/?article=458

www.securityfocus.com/bid/40285

exchange.xforce.ibmcloud.com/vulnerabilities/58724

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

AI Score

6.4

Confidence

Low

EPSS

0.002

Percentile

56.6%

JSON

Related for CVE-2010-1548