CVE-2014-1400

Опубликовано: 10 апр. 2018

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

The entity_access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions and read unpublished comments via unspecified vectors.

Ссылки

http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126811.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126816.html
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/01/09/3
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/64729
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1050802
Issue Tracking
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/90396
Third Party Advisory
VDB Entry
https://www.drupal.org/node/2169595
Patch
Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126811.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-January/126816.html
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/01/09/3
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/64729
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1050802
Issue Tracking
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/90396
Third Party Advisory
VDB Entry
https://www.drupal.org/node/2169595
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:entity_api_project:entity_api:7.x-1.0:*:*:*:*:drupal:*:*

cpe:2.3:a:entity_api_project:entity_api:7.x-1.1:*:*:*:*:drupal:*:*

cpe:2.3:a:entity_api_project:entity_api:7.x-1.2:*:*:*:*:drupal:*:*

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*

EPSS

Процентиль: 59%

0.00384

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-284

Связанные уязвимости

GHSA-67mq-wwm9-2xxh