Design/Logic Flaw

2009-11-0917:30:00

PRIOn knowledge base

www.prio-n.com

6.9 Medium

AI Score

Confidence

Low

0.006 Low

EPSS

Percentile

78.1%

JSON

An administration page in the NGP COO/CWP Integration (crmngp) module 6.x before 6.x-1.12 for Drupal does not perform the expected access control, which allows remote attackers to read log information via unspecified vectors.

CPENameOperatorVersion
crmngpeq6.120.10
crmngpeq6.120.11
crmngpeq6.120.12
crmngpeq6.120.13
crmngpeq6.120.14
crmngpeq6.120.15
crmngpeq6.120.16
crmngpeq6.120.18
crmngpeq6.120.19
crmngpeq6.120.110

Name	Operator	Version
crmngp	eq	6.120.10
crmngp	eq	6.120.11
crmngp	eq	6.120.12
crmngp	eq	6.120.13
crmngp	eq	6.120.14
crmngp	eq	6.120.15
crmngp	eq	6.120.16
crmngp	eq	6.120.18
crmngp	eq	6.120.19
crmngp	eq	6.120.110

Rows per page:

1-10 of 111

References

osvdb.org/59677

secunia.com/advisories/37287

www.securityfocus.com/bid/36927

drupal.org/node/623506

drupal.org/node/623546

exchange.xforce.ibmcloud.com/vulnerabilities/54153