PT-2011-3272 · Drupal · Node Quick Find

Publicado 2011-04-10 · Atualizado 2017-08-17 · CVE-2011-1661

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Node Quick Find module version 6.x-1.1

Description The issue allows remote attackers to bypass intended access restrictions and read potentially sensitive node titles via the autocomplete feature, due to the module not using db rewrite sql when presenting node titles.

Recommendations For Node Quick Find module version 6.x-1.1, consider disabling the autocomplete feature until a patch is available to prevent the bypassing of access restrictions.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-1661

Produtos afetados

Node Quick Find

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2011-1661 · Nota de Segurança
• http://securityfocus.com/bid/47238 · Nota
• http://drupal.org/node/1080114 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66604 · Nota
• http://secunia.com/advisories/44046 · Aviso do Fabricante
• http://drupal.org/files/issues/db_rewrite_sql_12.patch · Correção
• http://drupal.org/node/1118408 · Aviso do Fabricante