CVE-2011-1661

The Node Quick Find module 6.x-1.1 for Drupal does not use db_rewrite_sql when presenting node titles, which allows remote attackers to bypass intended access restrictions and read potentially sensitive node titles via the autocomplete feature.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2011-04-10

Last modified

2024-08-06

Weaknesses

CWE-264

Affected products

• Node Quick Find (Nicholas Thompson)

References

• http://drupal.org/files/issues/db_rewrite_sql_12.patch
• http://drupal.org/node/1080114
• http://drupal.org/node/1118408
• http://secunia.com/advisories/44046
• http://www.securityfocus.com/bid/47238
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66604