6 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
0.967 High
EPSS
Percentile
99.7%
CVE: CVE-2012-1638
The Search Autocomplete module allows you to add autocomplete functionality to the search fields of a Drupal site.
Search Autocomplete does not properly use Drupal’s database API, making it possible for a malicious user to carryout SQL injection on the site. This vulnerability is mitigated by the fact that users must have a role with permission “use search_autocomplete” to exploit.
Drupal core is not affected. If you do not use the contributed Search Autocomplete module, there is nothing you need to do.
Install the latest version:
See the Search Autocomplete project page for more information.