CVE-2011-1661 The Node Quick Find module 6.x-1.1 for Drupal does not use db_rewrite_sql when presenting node titles, which allows remote attackers to bypass intended access restrictions and read potentially sensiti...
MediumCVSS 5.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Node Quick Find module 6.x-1.1 for Drupal does not use db_rewrite_sql when presenting node titles, which allows remote attackers to bypass intended access restrictions and read potentially sensitive node titles via the autocomplete feature.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nicholas thompson node quick find | = 6.x-1.1 | No fix listed |
References
- drupal.org patch
- drupal.org patch
- drupal.org patch vendor-advisory
- 44046 third-party-advisory vendor-advisory
- 47238 vdb-entry
- nodequickfind-dbrewritesql-info-disc(66604) vdb-entry