CVE-2010-2353

The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
OR cpe:2.3:a:yves_chedemois:cck:6.x-1.0-alpha:*:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-1.x-dev:*:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.0:*:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.0:beta:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc1:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc10:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc2:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc3:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc4:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc5:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc6:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc7:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc8:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc9:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.1:*:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.2:*:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.3:*:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.4:*:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.5:*:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.6:*:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-2.x-dev:*:*:*:*:*:*:*
cpe:2.3:a:yves_chedemois:cck:6.x-3.x-dev:*:*:*:*:*:*:*

History

No history.

Information

Published : 2010-06-21 19:30

Updated : 2024-02-04 17:54


NVD link : CVE-2010-2353

Mitre link : CVE-2010-2353

CVE.ORG link : CVE-2010-2353


JSON object : View

Products Affected

yves_chedemois

  • cck

drupal

  • drupal
CWE
CWE-264

Permissions, Privileges, and Access Controls