CVE-2015-4375: Infoleak
First published: Mon Jun 15 2015(Updated: )
The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an autocomplete search on custom entities without an access query tag or (2) leveraging knowledge of the ID of an entity.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Chaos Tool Suite (Ctools) for Drupal | =7.x-1.0 | |
| Chaos Tool Suite (Ctools) for Drupal | =7.x-1.1 | |
| Chaos Tool Suite (Ctools) for Drupal | =7.x-1.2 | |
| Chaos Tool Suite (Ctools) for Drupal | =7.x-1.3 | |
| Chaos Tool Suite (Ctools) for Drupal | =7.x-1.4 | |
| Chaos Tool Suite (Ctools) for Drupal | =7.x-1.5 | |
| Chaos Tool Suite (Ctools) for Drupal | =7.x-1.6 | |
| Chaos Tool Suite (Ctools) for Drupal | =7.x-1.6-rc1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the impact of CVE-2015-4375?
CVE-2015-4375 allows remote attackers to access sensitive node titles via an autocomplete search on custom entities.
Which versions of Ctools are affected by CVE-2015-4375?
CVE-2015-4375 affects all versions of Chaos Tool Suite (Ctools) from 7.x-1.0 to 7.x-1.6.
How do I fix CVE-2015-4375?
To fix CVE-2015-4375, upgrade to Chaos Tool Suite (Ctools) version 7.x-1.7 or later.
Who can be affected by CVE-2015-4375?
All Drupal installations using affected versions of Ctools can be exploited if they allow unauthorized access to autocomplete functionality.
What kind of vulnerability is CVE-2015-4375 classified as?
CVE-2015-4375 is classified as an information disclosure vulnerability due to the exposure of sensitive information.
- agent/references
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/chaos tool suite project
- canonical/chaos tool suite (ctools) for drupal
- version/chaos tool suite (ctools) for drupal/7.x-1.0
- version/chaos tool suite (ctools) for drupal/7.x-1.1
- version/chaos tool suite (ctools) for drupal/7.x-1.2
- version/chaos tool suite (ctools) for drupal/7.x-1.3
- version/chaos tool suite (ctools) for drupal/7.x-1.4
- version/chaos tool suite (ctools) for drupal/7.x-1.5
- version/chaos tool suite (ctools) for drupal/7.x-1.6
- version/chaos tool suite (ctools) for drupal/7.x-1.6-rc1