Lucene search

[email protected]CVE-2015-5515

HistoryAug 18, 2015 - 6:00 p.m.

CVE-2015-5515

2015-08-1818:00:21

CWE-264

[email protected]

web.nvd.nist.gov

cve

2015

5515

vbo module

drupal

unauthorized access

4.9 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:N/I:P/A:P

6.6 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

62.0%

JSON

The Views Bulk Operations (VBO) module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operation for changing Roles is enabled, allows remote authenticated users to edit user accounts and add arbitrary roles to the accounts by leveraging access to a user account listing view with VBO enabled.

Affected configurations

NVD

Node

views_bulk_operations_projectviews_bulk_operationsMatch6.x-1.17drupal

views_bulk_operations_projectviews_bulk_operationsMatch6.x-1.xdevdrupal

views_bulk_operations_projectviews_bulk_operationsMatch7.x-3.0drupal

views_bulk_operations_projectviews_bulk_operationsMatch7.x-3.0alpha1drupal

views_bulk_operations_projectviews_bulk_operationsMatch7.x-3.0alpha2drupal

views_bulk_operations_projectviews_bulk_operationsMatch7.x-3.0alpha3drupal

views_bulk_operations_projectviews_bulk_operationsMatch7.x-3.0beta1drupal

views_bulk_operations_projectviews_bulk_operationsMatch7.x-3.0beta2drupal

views_bulk_operations_projectviews_bulk_operationsMatch7.x-3.0beta3drupal

views_bulk_operations_projectviews_bulk_operationsMatch7.x-3.0rc1drupal

views_bulk_operations_projectviews_bulk_operationsMatch7.x-3.1drupal

views_bulk_operations_projectviews_bulk_operationsMatch7.x-3.2drupal

views_bulk_operations_projectviews_bulk_operationsMatch7.x-3.xdevdrupal

CPENameOperatorVersion
views_bulk_operations_project:views_bulk_operationsviews bulk operations project views bulk operationseq6.x-1.17
views_bulk_operations_project:views_bulk_operationsviews bulk operations project views bulk operationseq6.x-1.x
views_bulk_operations_project:views_bulk_operationsviews bulk operations project views bulk operationseq7.x-3.0
views_bulk_operations_project:views_bulk_operationsviews bulk operations project views bulk operationseq7.x-3.1
views_bulk_operations_project:views_bulk_operationsviews bulk operations project views bulk operationseq7.x-3.2
views_bulk_operations_project:views_bulk_operationsviews bulk operations project views bulk operationseq7.x-3.x

CPE	Name	Operator	Version
views_bulk_operations_project:views_bulk_operations	views bulk operations project views bulk operations	eq	6.x-1.17
views_bulk_operations_project:views_bulk_operations	views bulk operations project views bulk operations	eq	6.x-1.x
views_bulk_operations_project:views_bulk_operations	views bulk operations project views bulk operations	eq	7.x-3.0
views_bulk_operations_project:views_bulk_operations	views bulk operations project views bulk operations	eq	7.x-3.1
views_bulk_operations_project:views_bulk_operations	views bulk operations project views bulk operations	eq	7.x-3.2
views_bulk_operations_project:views_bulk_operations	views bulk operations project views bulk operations	eq	7.x-3.x

References

www.openwall.com/lists/oss-security/2015/07/04/4

www.securityfocus.com/bid/75547

www.drupal.org/node/2516680

www.drupal.org/node/2516688

4.9 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:N/I:P/A:P

6.6 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

62.0%

JSON

Related for CVE-2015-5515

cvelist1 prion1 nvd1 drupal1