5

CVE-2011-1661

The Node Quick Find module 6.x-1.1 for Drupal does not use db_rewrite_sql when presenting node titles, which allows remote attackers to bypass intended access restrictions and read potentially sensitive node titles via the autocomplete feature.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nicholas Thompson ≫ Node Quick Find Version6.x-1.1
   Drupal ≫ Drupal
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.47% 0.704
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://drupal.org/files/issues/db_rewrite_sql_12.patch
Patch
http://drupal.org/node/1080114
Patch
http://drupal.org/node/1118408
Patch
Vendor Advisory
http://secunia.com/advisories/44046
Vendor Advisory
http://www.securityfocus.com/bid/47238
https://exchange.xforce.ibmcloud.com/vulnerabilities/66604