CVSS: 5.0EPSS: 0%CPEs: 23EXPL: 0CVE-2010-2353
https://notcve.org/view.php?id=CVE-2010-2353
The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes. El módulo "Node Reference" (referencia de nodo) en el módulo "Content Construction Kit" (CCK o kit de construcción de contenido) v6.x en versiones anteriores a la v6.x-2.7 para Drupal no realiza comprobaciones de acceso para el campo "source" (fuente) en la URL de administración para la funcionalidad autocompletar (autocomplete widget), lo que permite a atacantes remotos descubrir títulos e IDs de los nodos controlados. • http://drupal.org/node/829566 http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html http://osvdb.org/65615 http://secunia.com/advisories/40243 http://secunia.com/advisories/40318 http://www.vupen.com/english/advisories/2010/1546 https://exchange.xforce.ibmcloud.com/vulnerabilities/59515 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 31EXPL: 0CVE-2010-2352
https://notcve.org/view.php?id=CVE-2010-2352
The Node Reference module in Content Construction Kit (CCK) module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes. El módulo "Node Reference" (referencia de nodo) en el módulo "Content Construction Kit" (CCK o kit de construcción de contenido) v5.x en versiones anteriores a la v5.x-1.11 y v6.x en versiones anteriores a la v6.x-2.7 para Drupal no realiza comprobaciones de acceso antes de mostrar los nodos referenciados, lo que permite a atacantes remotos leer los nodos controlados. • http://drupal.org/node/829566 http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html http://osvdb.org/65615 http://secunia.com/advisories/40243 http://secunia.com/advisories/40318 http://www.vupen.com/english/advisories/2010/1546 https://exchange.xforce.ibmcloud.com/vulnerabilities/59515 • CWE-20: Improper Input Validation •