4

CVE-2013-1973

The autocomplete callback in Autocomplete Widgets for Text and Number Fields (autocomplete_widgets) module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-rc1 does not properly handle node permissions, which allows remote authenticated users to obtain sensitive field values via unspecified vectors.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Autocomplete Widgets Project ≫ Autocomplete Widgets Version 6.x-1.0 Update - Edition - SwEdition - SwPlatform drupal
Autocomplete Widgets Project ≫ Autocomplete Widgets Version 6.x-1.1 Update - Edition - SwEdition - SwPlatform drupal
Autocomplete Widgets Project ≫ Autocomplete Widgets Version 6.x-1.2 Update - Edition - SwEdition - SwPlatform drupal
Autocomplete Widgets Project ≫ Autocomplete Widgets Version 6.x-1.3 Update - Edition - SwEdition - SwPlatform drupal
Autocomplete Widgets Project ≫ Autocomplete Widgets Version 7.x-1.x Update alpha1 Edition - SwEdition - SwPlatform drupal
Autocomplete Widgets Project ≫ Autocomplete Widgets Version 7.x-1.x Update beta1 Edition - SwEdition - SwPlatform drupal
Autocomplete Widgets Project ≫ Autocomplete Widgets Version 7.x-1.x Update beta2 Edition - SwEdition - SwPlatform drupal
Autocomplete Widgets Project ≫ Autocomplete Widgets Version 7.x-1.x Update dev Edition - SwEdition - SwPlatform drupal
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.09% 0.612
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://osvdb.org/92532
http://secunia.com/advisories/52996
https://drupal.org/node/1971848
Patch
https://drupal.org/node/1971856
Patch
https://drupal.org/node/1972976
Patch
Vendor Advisory