CVE-2015-6661

Drupal 6.x < 6.37 and 7.x < 7.39 - Unauthenticated Sensitive Node Title Exposure via Menu

Title source: llm
STIX 2.1

Description

Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.

References (9)

Core 9
Core References
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165723.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1033358
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165840.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165733.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2015/dsa-3346
Patch, Vendor Advisory x_refsource_confirm
https://www.drupal.org/SA-CORE-2015-003
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165690.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165704.html

Scores

EPSS 0.0081
EPSS Percentile 74.5%

Details

CWE
CWE-200
Status published
Products (38)
drupal/drupal 6.0 (6 CPE variants)
drupal/drupal 6.1
drupal/drupal 6.2
drupal/drupal 6.3
drupal/drupal 6.4
drupal/drupal 6.5
drupal/drupal 6.6
drupal/drupal 6.7
drupal/drupal 6.8
drupal/drupal 6.9
... and 28 more
Published Aug 24, 2015
Tracked Since Feb 18, 2026