Description
The Certify module before 6.x-2.3 for Drupal does not properly perform node access checks, which allows remote authenticated users to bypass intended access restrictions and obtain sensitive PDF certificate information via vectors related to "showing (and creating) the PDF certificates."
References (5)
Core 5
Core References
Patch x_refsource_confirm
https://www.drupal.org/node/2407081
Patch, Vendor Advisory x_refsource_misc
https://www.drupal.org/node/2415947
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/01/29/6
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/04/21/8
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/74282
Scores
EPSS
0.0070
EPSS Percentile
48.6%
Details
CWE
CWE-200
Status
published
Products (1)
certify_project/certify
6.x-2.2
Published
Apr 22, 2015
Tracked Since
Feb 18, 2026