← Back

CVE-2010-2353

nvd nist
Published: Jun 21, 2010Modified: Apr 29, 2026

JSON object

Loading...
5.0
Vector
AV:N/AC:L/Au:N/C:P/I:N/A:N
Exploitability: 10.0 / Impact: 2.9
Source: NVD

Description

The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes.

Affected (22)

Products: Yves Chedemois: Cck
Yves Chedemois
1 product
Cck
Configuration A
22 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Yves Chedemois
Cck
Version 6.x-1.0-alpha
Cck
Version 6.x-1.x-dev
Cck
Version 6.x-2.0
Cck
Version 6.x-2.0 beta
Cck
Version 6.x-2.0 rc10
Cck
Version 6.x-2.0 rc1
Cck
Version 6.x-2.0 rc2
Cck
Version 6.x-2.0 rc3
Cck
Version 6.x-2.0 rc4
Cck
Version 6.x-2.0 rc5
Cck
Version 6.x-2.0 rc6
Cck
Version 6.x-2.0 rc7
Cck
Version 6.x-2.0 rc8
Cck
Version 6.x-2.0 rc9
Cck
Version 6.x-2.1
Cck
Version 6.x-2.2
Cck
Version 6.x-2.3
Cck
Version 6.x-2.4
Cck
Version 6.x-2.5
Cck
Version 6.x-2.6
Cck
Version 6.x-2.x-dev
Cck
Version 6.x-3.x-dev
Running on/withPlatform Versions
Drupal
Drupal
All versions

Related CWEs

CWE-264
CWE-264

References (18)

Source: cve@mitre.org
Patch
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.