PT-2012-4212 · Drupal+1 · Node Embed+1

Publicado 2012-06-27 · Atualizado 2017-08-29 · CVE-2012-2722

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Node Embed module versions 6.x-1.x before 6.x-1.5 Node Embed module versions 7.x-1.x before 7.x-1.0

Description The issue is related to the node selection interface in the WYSIWYG editor (CKEditor) of the Node Embed module for Drupal. It does not properly check permissions, allowing remote attackers to bypass intended access restrictions and read node titles.

Recommendations For Node Embed module versions 6.x-1.x before 6.x-1.5, update to version 6.x-1.5 or later. For Node Embed module versions 7.x-1.x before 7.x-1.0, update to version 7.x-1.0 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-2722

Produtos afetados

Ckeditor

Node Embed

Referências · 11

• 🔥 http://drupalcode.org/project/node_embed.git/commitdiff/7a2296c · Exploit
• 🔥 http://drupalcode.org/project/node_embed.git/commitdiff/d06f022 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76148 · Nota
• http://openwall.com/lists/oss-security/2012/06/14/3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2722 · Nota de Segurança
• http://drupal.org/node/1618430 · Correção
• http://drupal.org/node/1619824 · Aviso do Fabricante
• http://secunia.com/advisories/48348 · Aviso do Fabricante
• http://drupal.org/node/1618428 · Correção
• http://securityfocus.com/bid/53835 · Nota
• http://osvdb.org/82735 · Nota