5

CVE-2010-2352

The Node Reference module in Content Construction Kit (CCK) module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Karen Stevenson ≫ Cck Version 5.x-1.0 Update beta
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 5.x-1.1
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 5.x-1.2
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 5.x-1.3
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 5.x-1.7
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 5.x-1.x Update dev
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.0
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.0 Update beta
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.0 Update rc10
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.0 Update rc2
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.0 Update rc3
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.0 Update rc4
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.0 Update rc5
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.0 Update rc6
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.0 Update rc7
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.0 Update rc8
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.0 Update rc9
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.1
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.2
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.3
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.4
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.5
   Drupal ≫ Drupal
Karen Stevenson ≫ Cck Version 6.x-2.6
   Drupal ≫ Drupal
Yves Chedemois ≫ Cck Version 5.x-1.4
   Drupal ≫ Drupal
Yves Chedemois ≫ Cck Version 5.x-1.5
   Drupal ≫ Drupal
Yves Chedemois ≫ Cck Version 5.x-1.6
   Drupal ≫ Drupal
Yves Chedemois ≫ Cck Version 5.x-1.6-1
   Drupal ≫ Drupal
Yves Chedemois ≫ Cck Version 5.x-1.8
   Drupal ≫ Drupal
Yves Chedemois ≫ Cck Version 5.x-1.9
   Drupal ≫ Drupal
Yves Chedemois ≫ Cck Version 5.x-1.10
   Drupal ≫ Drupal
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.56% 0.831
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://drupal.org/node/829566
Patch
Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html
http://osvdb.org/65615
http://secunia.com/advisories/40243
Vendor Advisory
http://secunia.com/advisories/40318
http://www.vupen.com/english/advisories/2010/1546
https://exchange.xforce.ibmcloud.com/vulnerabilities/59515