CVE-2015-5502
Published Aug 18, 2015
Last updated 8 years ago
Overview
- Description
- The Storage API module 7.x-1.x before 7.x-1.8 for Drupal does not properly restrict access to Storage API fields attached to entities that are not nodes, which allows remote attackers to have unspecified impact via unknown vectors.
- Source
- cve@mitre.org
- NVD status
- Modified
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 7.5
- Impact score
- 6.4
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-284
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:storage_api_project:storage_api:7.x-1.0:*:*:*:*:drupal:*:*",
"vulnerable": true,
"matchCriteriaId": "F53BD86D-1D12-483D-8425-3186AF742319"
},
{
"criteria": "cpe:2.3:a:storage_api_project:storage_api:7.x-1.1:*:*:*:*:drupal:*:*",
"vulnerable": true,
"matchCriteriaId": "F477505A-B044-49B2-906E-9E60F3401638"
},
{
"criteria": "cpe:2.3:a:storage_api_project:storage_api:7.x-1.2:*:*:*:*:drupal:*:*",
"vulnerable": true,
"matchCriteriaId": "431F0BCF-BF18-47D6-B2AB-C0B6BF76C2B1"
},
{
"criteria": "cpe:2.3:a:storage_api_project:storage_api:7.x-1.3:*:*:*:*:drupal:*:*",
"vulnerable": true,
"matchCriteriaId": "381362AD-2BFF-4E72-9C3D-2C2546A3A5BC"
},
{
"criteria": "cpe:2.3:a:storage_api_project:storage_api:7.x-1.4:*:*:*:*:drupal:*:*",
"vulnerable": true,
"matchCriteriaId": "0E70C665-BBF9-4A90-9272-AF3C80881BB2"
},
{
"criteria": "cpe:2.3:a:storage_api_project:storage_api:7.x-1.5:*:*:*:*:drupal:*:*",
"vulnerable": true,
"matchCriteriaId": "8D3BEF4E-B13E-465F-AFC6-EA8D07A72803"
},
{
"criteria": "cpe:2.3:a:storage_api_project:storage_api:7.x-1.6:*:*:*:*:drupal:*:*",
"vulnerable": true,
"matchCriteriaId": "9ADC64DB-1C19-4B98-9EC3-667627D975F6"
},
{
"criteria": "cpe:2.3:a:storage_api_project:storage_api:7.x-1.7:*:*:*:*:drupal:*:*",
"vulnerable": true,
"matchCriteriaId": "06A1BE72-41F1-492E-9404-8A25967B5306"
}
],
"operator": "OR"
}
]
}
]