CVE-2015-7875: High severity chaos tool suite (ctools) for drupal vulnerability
Published Aug 7, 2017
·Updated
ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on Panels and similar systems to place content and functionality on a page.
Affected Software
39 affected components
Chaos Tool Suite Project Ctools Drupal=6.x-1.0
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-alpha1
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-alpha2
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-alpha3
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-beta1
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-beta2
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-beta3
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-beta4
Chaos Tool Suite Project Ctools Drupal=6.x-1.0-rc1
Chaos Tool Suite Project Ctools Drupal=6.x-1.1
Chaos Tool Suite Project Ctools Drupal=6.x-1.2
Chaos Tool Suite Project Ctools Drupal=6.x-1.3
Chaos Tool Suite Project Ctools Drupal=6.x-1.4
Chaos Tool Suite Project Ctools Drupal=6.x-1.5
Chaos Tool Suite Project Ctools Drupal=6.x-1.6
Chaos Tool Suite Project Ctools Drupal=6.x-1.7
Chaos Tool Suite Project Ctools Drupal=6.x-1.8
Chaos Tool Suite Project Ctools Drupal=6.x-1.9
Chaos Tool Suite Project Ctools Drupal=6.x-1.11
Chaos Tool Suite Project Ctools Drupal=6.x-1.12
Chaos Tool Suite Project Ctools Drupal=6.x-1.13
Chaos Tool Suite Project Ctools Drupal=6.x-1.x-dev
Chaos Tool Suite Project Ctools Drupal=7.x-1.0
Chaos Tool Suite Project Ctools Drupal=7.x-1.0-alpha1
Chaos Tool Suite Project Ctools Drupal=7.x-1.0-alpha2
Chaos Tool Suite Project Ctools Drupal=7.x-1.0-alpha3
Chaos Tool Suite Project Ctools Drupal=7.x-1.0-alpha4
Chaos Tool Suite Project Ctools Drupal=7.x-1.0-beta1
Chaos Tool Suite Project Ctools Drupal=7.x-1.0-rc1
Chaos Tool Suite Project Ctools Drupal=7.x-1.0-rc2
Chaos Tool Suite Project Ctools Drupal=7.x-1.1
Chaos Tool Suite Project Ctools Drupal=7.x-1.2
Chaos Tool Suite Project Ctools Drupal=7.x-1.3
Chaos Tool Suite Project Ctools Drupal=7.x-1.4
Chaos Tool Suite Project Ctools Drupal=7.x-1.5
Chaos Tool Suite Project Ctools Drupal=7.x-1.6
Chaos Tool Suite Project Ctools Drupal=7.x-1.6-rc1
Chaos Tool Suite Project Ctools Drupal=7.x-1.7
Chaos Tool Suite Project Ctools Drupal=7.x-1.x-dev
Event History
Aug 7, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-7875?
CVE-2015-7875 has been classified as a moderate severity vulnerability.
2
How do I fix CVE-2015-7875?
To fix CVE-2015-7875, update the Chaos Tool Suite (Ctools) to version 6.x-1.14 or 7.x-1.8 or later.
3
What types of systems are affected by CVE-2015-7875?
CVE-2015-7875 affects Drupal systems using the Chaos Tool Suite (Ctools) versions prior to the specified updates.
4
What is the impact of CVE-2015-7875 on user permissions?
CVE-2015-7875 allows unauthorized users to bypass the 'edit' permission for content type plugins.
5
When was CVE-2015-7875 publicly disclosed?
CVE-2015-7875 was publicly disclosed on October 21, 2015.