CVE-2010-1548: Low severity Chaos Tool Suite Project Ctools Drupal vulnerability
The auto-complete functionality in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal does not follow access restrictions, which allows remote authenticated users, with "access content" privileges, to read the title of an unpublished node via a q=ctools/autocomplete/node/ value accompanied by the first character of the node's title.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1548?
CVE-2010-1548 has a medium severity rating due to unauthorized access to unpublished node titles.
How do I fix CVE-2010-1548?
To fix CVE-2010-1548, update the Chaos Tool Suite module to version 6.x-1.4 or later.
Who is affected by CVE-2010-1548?
CVE-2010-1548 affects users of Chaos Tool Suite versions prior to 6.x-1.4 in Drupal.
What is the impact of CVE-2010-1548?
CVE-2010-1548 allows authenticated users to read the titles of unpublished nodes, which could lead to information disclosure.
What versions are impacted by CVE-2010-1548?
CVE-2010-1548 impacts multiple versions of the Chaos Tool Suite for Drupal, specifically all versions before 6.x-1.4.