Lucene search

[email protected]CVE-2013-1973

HistoryJun 09, 2014 - 7:55 p.m.

CVE-2013-1973

2014-06-0919:55:06

CWE-264

[email protected]

web.nvd.nist.gov

cve-2013-1973

autocomplete widgets

text fields

number fields

node permissions

remote user

security vulnerability

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.2 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

55.9%

JSON

The autocomplete callback in Autocomplete Widgets for Text and Number Fields (autocomplete_widgets) module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-rc1 does not properly handle node permissions, which allows remote authenticated users to obtain sensitive field values via unspecified vectors.

Affected configurations

NVD

Node

autocomplete_widgets_projectautocomplete_widgetsMatch6.x-1.0---drupal

autocomplete_widgets_projectautocomplete_widgetsMatch6.x-1.1---drupal

autocomplete_widgets_projectautocomplete_widgetsMatch6.x-1.2---drupal

autocomplete_widgets_projectautocomplete_widgetsMatch6.x-1.3---drupal

autocomplete_widgets_projectautocomplete_widgetsMatch7.x-1.xalpha1--drupal

autocomplete_widgets_projectautocomplete_widgetsMatch7.x-1.xbeta1--drupal

autocomplete_widgets_projectautocomplete_widgetsMatch7.x-1.xbeta2--drupal

autocomplete_widgets_projectautocomplete_widgetsMatch7.x-1.xdev--drupal

CPENameOperatorVersion
autocomplete_widgets_project:autocomplete_widgetsautocomplete widgets project autocomplete widgetseq6.x-1.0
autocomplete_widgets_project:autocomplete_widgetsautocomplete widgets project autocomplete widgetseq6.x-1.1
autocomplete_widgets_project:autocomplete_widgetsautocomplete widgets project autocomplete widgetseq6.x-1.2
autocomplete_widgets_project:autocomplete_widgetsautocomplete widgets project autocomplete widgetseq6.x-1.3
autocomplete_widgets_project:autocomplete_widgetsautocomplete widgets project autocomplete widgetseq7.x-1.x

CPE	Name	Operator	Version
autocomplete_widgets_project:autocomplete_widgets	autocomplete widgets project autocomplete widgets	eq	6.x-1.0
autocomplete_widgets_project:autocomplete_widgets	autocomplete widgets project autocomplete widgets	eq	6.x-1.1
autocomplete_widgets_project:autocomplete_widgets	autocomplete widgets project autocomplete widgets	eq	6.x-1.2
autocomplete_widgets_project:autocomplete_widgets	autocomplete widgets project autocomplete widgets	eq	6.x-1.3
autocomplete_widgets_project:autocomplete_widgets	autocomplete widgets project autocomplete widgets	eq	7.x-1.x

References

osvdb.org/92532

secunia.com/advisories/52996

drupal.org/node/1971848

drupal.org/node/1971856

drupal.org/node/1972976

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.2 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

55.9%

JSON

Related for CVE-2013-1973

prion1 cvelist1 drupal1 nvd1