Lucene search

[email protected]CVE-2015-8602

HistoryOct 03, 2022 - 4:16 p.m.

CVE-2015-8602

2022-10-0316:16:00

CWE-200

[email protected]

web.nvd.nist.gov

cve-2015-8602

token insert entity

drupal

nvd

security vulnerability

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

6.2 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

46.6%

JSON

The Token Insert Entity module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote authenticated users with certain permissions to bypass intended access restrictions and possibly obtain sensitive information by inserting a token, which embeds a rendered entity in the main node.

Affected configurations

NVD

Node

token_insert_entity_projecttoken_insert_entityMatch7.x-1.0drupal

CPENameOperatorVersion
token_insert_entity_project:token_insert_entitytoken insert entity project token insert entityeq7.x-1.0

CPE	Name	Operator	Version
token_insert_entity_project:token_insert_entity	token insert entity project token insert entity	eq	7.x-1.0

References

www.drupal.org/node/2571905

www.drupal.org/node/2627638

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

6.2 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

46.6%

JSON

Related for CVE-2015-8602

nvd1 drupal1 prion1 cvelist1