CVE-2015-7229
First published: Thu Sep 17 2015(Updated: )
The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the (1) "post to twitter" permission or change the options for arbitrary attached accounts by leveraging the (2) "add twitter accounts" or (3) "add authenticated twitter accounts" permission.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| =6.x-5.0 | ||
| =6.x-5.1 | ||
| =6.x-5.x-dev | ||
| =7.x-5.0 | ||
| =7.x-5.1 | ||
| =7.x-5.2 | ||
| =7.x-5.3 | ||
| =7.x-5.4 | ||
| =7.x-5.5 | ||
| =7.x-5.6 | ||
| =7.x-5.7 | ||
| =7.x-5.8 | ||
| =7.x-6.0-alpha1 | ||
| =7.x-6.0-alpha2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2015-7229?
CVE-2015-7229 has a moderate severity rating due to improper access permissions allowing exploitation.
How do I fix CVE-2015-7229?
To fix CVE-2015-7229, update the Twitter module for Drupal to version 6.x-5.2 or 7.x-5.9 or later.
Which versions of Drupal are affected by CVE-2015-7229?
CVE-2015-7229 affects the Twitter module versions 6.x-5.0 to 6.x-5.1 and 7.x-5.0 to 7.x-5.8.
What can attackers do with CVE-2015-7229?
Attackers can post tweets to arbitrary accounts if they have privileged access due to the vulnerability in access permissions.
Is CVE-2015-7229 a remote vulnerability?
Yes, CVE-2015-7229 allows remote authenticated users to exploit it under certain conditions.
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- vendor/twitter project
- canonical/twitter
- version/twitter/6.x-5.0
- version/twitter/6.x-5.1
- version/twitter/6.x-5.x-dev
- version/twitter/7.x-5.0
- version/twitter/7.x-5.1
- version/twitter/7.x-5.2
- version/twitter/7.x-5.3
- version/twitter/7.x-5.4
- version/twitter/7.x-5.5
- version/twitter/7.x-5.6
- version/twitter/7.x-5.7
- version/twitter/7.x-5.8
- version/twitter/7.x-6.0-alpha1
- version/twitter/7.x-6.0-alpha2