CVE-2015-7306

2022-10-0316:15:55

mitre

www.cve.org

drupal

cms updater

access permissions

6.3 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

40.1%

JSON

The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated users to access and change settings by leveraging the “access administration pages” permission.

References

www.drupal.org/node/2569111

www.drupal.org/node/2569599