CVE-2015-8602

The Token Insert Entity module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote authenticated users with certain permissions to bypass intended access restrictions and possibly obtain sensitive information by inserting a token, which embeds a rendered entity in the main node.

Score

CVSS 2.0 3.5 Low

Status

Modified - cve@mitre.org

Published

2015-12-17

Last modified

2024-09-17

Weaknesses

CWE-200

Affected products

• Token Insert Entity (Token Insert Entity Project)

References

• https://www.drupal.org/node/2571905
• https://www.drupal.org/node/2627638