Lucene search
HistoryAug 14, 2012 - 10:55 p.m.
CVE-2012-2304
cve-2012-2304
linkit module
drupal
entity access module
remote attackers
sensitive information
nvd
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
6.4 Medium
AI Score
Confidence
Low
0.007 Low
EPSS
Percentile
79.8%
The Linkit module 7.x-2.x before 7.x-2.3 for Drupal, when using an entity access module, does not check permissions when searching for entities, which allows remote attackers to obtain sensitive information via unspecified vectors.
Affected configurations
Node
emil_stjernemanlinkitMatch7.x-2.0
ORemil_stjernemanlinkitMatch7.x-2.0beta1
ORemil_stjernemanlinkitMatch7.x-2.0beta2
ORemil_stjernemanlinkitMatch7.x-2.1
ORemil_stjernemanlinkitMatch7.x-2.2
ORemil_stjernemanlinkitMatch7.x-2.3
drupaldrupalMatch-
Related
cvelist
cvelist
CVE-2012-2304
2012-08-14 22:00:00
nvd
nvd
CVE-2012-2304
2012-08-14 22:55:02
drupal
drupal
SA-CONTRIB-2012-067 - Linkit - Access bypass
2012-04-25 00:00:00
prion
prion
Code injection
2012-08-14 22:55:00
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
6.4 Medium
AI Score
Confidence
Low
0.007 Low
EPSS
Percentile
79.8%
Related for CVE-2012-2304