PT-2011-3272 · Drupal · Node Quick Find

Published 2011-04-10 · Updated 2017-08-17 · CVE-2011-1661

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Node Quick Find module version 6.x-1.1

Description The issue allows remote attackers to bypass intended access restrictions and read potentially sensitive node titles via the autocomplete feature, due to the module not using db rewrite sql when presenting node titles.

Recommendations For Node Quick Find module version 6.x-1.1, consider disabling the autocomplete feature until a patch is available to prevent the bypassing of access restrictions.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-1661

Affected Products

Node Quick Find

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2011-1661 · Security Note
• http://drupal.org/node/1080114 · Patch
• http://secunia.com/advisories/44046 · Vendor Advisory
• http://drupal.org/files/issues/db_rewrite_sql_12.patch · Patch
• http://drupal.org/node/1118408 · Vendor Advisory
• http://securityfocus.com/bid/47238 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66604 · Note