PT-2014-2524 · Drupal · Autocomplete Widgets For Text/Number Fields

Published 2014-06-09 · Updated 2014-06-24 · CVE-2013-1973

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Autocomplete Widgets for Text and Number Fields (autocomplete widgets) module versions 6.x-1.x before 6.x-1.4 Autocomplete Widgets for Text and Number Fields (autocomplete widgets) module versions 7.x-1.x before 7.x-1.0-rc1

Description The issue concerns the autocomplete callback in the Autocomplete Widgets for Text and Number Fields module, which does not properly handle node permissions. This allows remote authenticated users to obtain sensitive field values.

Recommendations For Autocomplete Widgets for Text and Number Fields (autocomplete widgets) module version 6.x-1.x, update to version 6.x-1.4 or later. For Autocomplete Widgets for Text and Number Fields (autocomplete widgets) module version 7.x-1.x, update to version 7.x-1.0-rc1 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-1973

Affected Products

Autocomplete Widgets For Text/Number Fields

References · 6

• https://drupal.org/node/1971848 · Patch
• https://drupal.org/node/1972976 · Vendor Advisory
• https://drupal.org/node/1971856 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-1973 · Security Note
• http://secunia.com/advisories/52996 · Note
• http://osvdb.org/92532 · Note