Description
The Amazon AWS module before 7.x-1.3 for Drupal uses the base URL and AWS access key to generate the access token, which makes it easier for remote attackers to guess the token value and create backups via a crafted URL.
References (5)
Core 5
Core References
Patch x_refsource_confirm
http://cgit.drupalcode.org/aws_amazon/commit/?id=9377a26
Patch x_refsource_confirm
https://www.drupal.org/node/2415457
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/74277
Patch, Vendor Advisory x_refsource_misc
https://www.drupal.org/node/2415873
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/01/29/6
Scores
EPSS
0.0209
EPSS Percentile
79.3%
Details
CWE
CWE-200
Status
published
Products (1)
amazon_aws_project/amazon_aws
< 7.x-1.2
Published
Apr 21, 2015
Tracked Since
Feb 18, 2026