CVE-2015-4375

Chaos tool suite (ctools) < 7.x-1.7 - Unauthorized Sensitive Node Title Exposure via Autocomplete Search

Title source: llm
STIX 2.1

Description

The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an autocomplete search on custom entities without an access query tag or (2) leveraging knowledge of the ID of an entity.

References (4)

Core 4
Core References
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/03/22/35
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/04/25/6
Patch, Vendor Advisory x_refsource_misc
https://www.drupal.org/node/2454909
Patch x_refsource_confirm
https://www.drupal.org/node/2454883

Scores

EPSS 0.0123
EPSS Percentile 65.3%

Details

CWE
CWE-200
Status published
Products (7)
chaos_tool_suite_project/ctools 7.x-1.0
chaos_tool_suite_project/ctools 7.x-1.1
chaos_tool_suite_project/ctools 7.x-1.2
chaos_tool_suite_project/ctools 7.x-1.3
chaos_tool_suite_project/ctools 7.x-1.4
chaos_tool_suite_project/ctools 7.x-1.5
chaos_tool_suite_project/ctools 7.x-1.6 (2 CPE variants)
Published Jun 15, 2015
Tracked Since Feb 18, 2026