CVE-2015-8601

2015-12-1719:00:00

mitre

www.cve.org

drupal

chat room

unauthorized access

AI Score

6.8

Confidence

Low

EPSS

0.002

Percentile

60.8%

JSON

The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages, which allows remote attackers to bypass intended access restrictions and read messages from arbitrary Chat Rooms via unspecified vectors.

References

www.drupal.org/node/2627428

www.drupal.org/node/2627478