PT-2015-7516 · Drupal · Drupal Cms Updater Module

Published 2015-09-21 · Updated 2015-09-23 · CVE-2015-7306

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal CMS Updater module versions 7.x-1.x before 7.x-1.3

Description The issue allows remote authenticated users to access and change settings by leveraging the "access administration pages" permission, due to improper access permission checks.

Recommendations For versions prior to 7.x-1.3, update to version 7.x-1.3 or later to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2015-7306

Affected Products

Drupal Cms Updater Module

References · 3

• https://drupal.org/node/2569111 · Patch
• https://drupal.org/node/2569599 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7306 · Security Note