PT-2010-3221
CVE-2010-1548
·
تاريخ النشر
2010-05-21
·
تاريخ التحديث
2017-08-17
الوصف من
CVSS 2.0
3.5
منخفضةالمقاييسAV:N/AC:M/Au:S/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Chaos Tool Suite (aka CTools) module versions 6.x before 6.x-1.4 for Drupal
Description
The auto-complete functionality does not follow access restrictions, allowing remote authenticated users with "access content" privileges to read the title of an unpublished node. This can be achieved by using a specific value, such as 'q=ctools/autocomplete/node/' accompanied by the first character of the node's title, in the API endpoint "q=ctools/autocomplete/node/".
Recommendations
For Chaos Tool Suite (aka CTools) module versions 6.x before 6.x-1.4, update to version 6.x-1.4 or later to resolve the issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾