CVE-2015-5502 The Storage API module 7.x-1.x before 7.x-1.8 for Drupal does not properly restrict access to Storage API fields attached to entities that are not nodes, which allows remote attackers to have unspecif...
HighCVSS 7.5
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Storage API module 7.x-1.x before 7.x-1.8 for Drupal does not properly restrict access to Storage API fields attached to entities that are not nodes, which allows remote attackers to have unspecified impact via unknown vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| storage api project storage api | = 7.x-1.0 | No fix listed |
| storage api project storage api | = 7.x-1.1 | No fix listed |
| storage api project storage api | = 7.x-1.2 | No fix listed |
| storage api project storage api | = 7.x-1.3 | No fix listed |
| storage api project storage api | = 7.x-1.4 | No fix listed |
| storage api project storage api | = 7.x-1.5 | No fix listed |
| storage api project storage api | = 7.x-1.6 | No fix listed |
| storage api project storage api | = 7.x-1.7 | No fix listed |
References
- [oss-security] 20150704 CVE requests for Drupal contributed modules (from SA-CONTRIB-2015-100 to SA-CONTRIB-2015-131) mailing-list
- 74867 vdb-entry
- www.drupal.org patch
- www.drupal.org patch vendor-advisory