CVE-2014-9023 The Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not properly restrict access to the Twilio administration pages, which allows remote authenticated users to read and modify authentication toke...
MediumCVSS 5.5
EPSS 0.97%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not properly restrict access to the Twilio administration pages, which allows remote authenticated users to read and modify authentication tokens by leveraging the "access administration pages" Drupal permission.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| twilio project twilio | = 7.x-1.1 | No fix listed |
| twilio project twilio | = 7.x-1.2 | No fix listed |
| twilio project twilio | = 7.x-1.4 | No fix listed |
| twilio project twilio | = 7.x-1.5 | No fix listed |
| twilio project twilio | = 7.x-1.6 | No fix listed |
| twilio project twilio | = 7.x-1.8 | No fix listed |
| twilio project twilio | = 7.x-1.9 | No fix listed |
References
- www.drupal.org vendor-advisory
- www.drupal.org vendor-advisory