Code injection

2013-08-2822:55:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

70.4%

JSON

The Node access user reference module 6.x-3.x before 6.x-3.5 and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to content containing a user reference field when the author update/delete grants are enabled and the author’s user account is deleted, which allows remote attackers to modify the content via unspecified vectors.

CPENameOperatorVersion
nodeaccess_userreference_moduleeq6.x-3.0 rc4
nodeaccess_userreference_moduleeq6.x-3.0 rc6
nodeaccess_userreference_moduleeq6.120.30
nodeaccess_userreference_moduleeq6.x-3.0 rc5
nodeaccess_userreference_moduleeq6.x-3.0 rc1
nodeaccess_userreference_moduleeq6.x-3.0 rc2
nodeaccess_userreference_moduleeq6.x-3.0 rc3
nodeaccess_userreference_moduleeq6.120.31
nodeaccess_userreference_moduleeq6.120.32
nodeaccess_userreference_moduleeq6.120.33

Name	Operator	Version
nodeaccess_userreference_module	eq	6.x-3.0 rc4
nodeaccess_userreference_module	eq	6.x-3.0 rc6
nodeaccess_userreference_module	eq	6.120.30
nodeaccess_userreference_module	eq	6.x-3.0 rc5
nodeaccess_userreference_module	eq	6.x-3.0 rc1
nodeaccess_userreference_module	eq	6.x-3.0 rc2
nodeaccess_userreference_module	eq	6.x-3.0 rc3
nodeaccess_userreference_module	eq	6.120.31
nodeaccess_userreference_module	eq	6.120.32
nodeaccess_userreference_module	eq	6.120.33