CVE-2013-4273

Severity Score

4.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The Entity API module 7.x-1.x before 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows remote authenticated users to read the comments via unspecified vectors. NOTE: this identifier was SPLIT per ADT5 due to different researcher organizations. CVE-2013-7391 was assigned for the View vector.

El módulo Entity API 7.x-1.x anterior a 7.x-1.2 para Drupal no restringe debidamente el acceso a comentarios de nodos, lo que permite a usuarios remotos autenticados leer los comentarios a través de vectores no especificados. NOTA: este identificador fue dividido (SPLIT) por ADT5 debido a organizaciones diferentes de investigadores. CVE-2013-7391 fue asignado para el vector View.

*Credits: N/A

CVSS Scores

NISTv2 4.0

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-06-12 CVE Reserved
2014-07-19 CVE Published
2023-03-07 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (3)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2013/08/22/2	Mailing List
https://drupal.org/node/2065197	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC
https://drupal.org/node/2065207	2015-02-27

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.0 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.0"		drupal		Affected
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.0 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.0"		beta1, drupal		Affected
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.0 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.0"		beta10, drupal		Affected
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.0 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.0"		beta11, drupal		Affected
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.0 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.0"		beta2, drupal		Affected
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.0 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.0"		beta3, drupal		Affected
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.0 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.0"		beta4, drupal		Affected
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.0 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.0"		beta5, drupal		Affected
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.0 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.0"		beta6, drupal		Affected
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.0 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.0"		beta7, drupal		Affected
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.0 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.0"		beta8, drupal		Affected
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.0 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.0"		beta9, drupal		Affected
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.0 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.0"		rc1, drupal		Affected
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.0 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.0"		rc2, drupal		Affected
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.0 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.0"		rc3, drupal		Affected
Entity Api Project Search vendor "Entity Api Project"		Entity Api Search vendor "Entity Api Project" for product "Entity Api"				7.x-1.1 Search vendor "Entity Api Project" for product "Entity Api" and version "7.x-1.1"		drupal		Affected