CVE-2012-4471

The Search Autocomplete module 7.x-2.x before 7.x-2.4 for Drupal does not properly restrict access to the module admin page, which allows remote attackers to disable an autocompletion or change the priority order via unspecified vectors.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://drupal.org/node/1679422	Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/10/04/3
http://drupal.org/node/1649442	Patch
http://www.securityfocus.com/bid/54379

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:dominique_clause:search_autocomplete:7.x-2.3:::::::*
	cpe:2.3:a:dominique_clause:search_autocomplete:7.x-2.x:dev::::::
	cpe:2.3:a:dominique_clause:search_autocomplete:7.x-2.1:::::::*
	cpe:2.3:a:dominique_clause:search_autocomplete:7.x-2.0:::::::*

cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*

Information

Published : 2012-11-30 14:55

Updated : 2013-01-29 20:54

NVD link : CVE-2012-4471

Mitre link : CVE-2012-4471

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Products Affected

drupal

drupal

dominique_clause

search_autocomplete

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://drupal.org/node/1679422", "name": "http://drupal.org/node/1679422", "tags": ["Patch", "Vendor Advisory"], "refsource": "MISC"}, {"url": "http://www.openwall.com/lists/oss-security/2012/10/04/3", "name": "[oss-security] 20121003 Re: CVE Request for Drupal Contributed Modules", "tags": [], "refsource": "MLIST"}, {"url": "http://drupal.org/node/1649442", "name": "http://drupal.org/node/1649442", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/54379", "name": "54379", "tags": [], "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The Search Autocomplete module 7.x-2.x before 7.x-2.4 for Drupal does not properly restrict access to the module admin page, which allows remote attackers to disable an autocompletion or change the priority order via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2012-4471", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "acInsufInfo": true, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2012-11-30T22:55Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:dominique_clause:search_autocomplete:7.x-2.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:dominique_clause:search_autocomplete:7.x-2.x:dev:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:dominique_clause:search_autocomplete:7.x-2.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:dominique_clause:search_autocomplete:7.x-2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2013-01-30T04:54Z"}

5.0 /10