Security bypass in Drupal - #VU452
Published: September 15, 2016
Vulnerability identifier: #VU452
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Drupal
Affected software:
Drupal
Drupal
Detailed vulnerability description
The vulnerability allows a remote user to obtain potentially sensitive data.
The weakness exists due to unsufficient access control. During API form submission a malicious user may bypass all security mechanisms and submit any element of the form.
Successful exploitation of the vulnerability results in access to potentially sensitive information.
The weakness exists due to unsufficient access control. During API form submission a malicious user may bypass all security mechanisms and submit any element of the form.
Successful exploitation of the vulnerability results in access to potentially sensitive information.