CVE-2015-3404
Last modified
CVE-2015-3404 is a vulnerability of currently unknown severity. The Certify module before 6.x-2.3 for Drupal does not properly perform node access checks, which allows remote authenticated users to bypass intended access restrictions and obtain sensitive PDF certificate information via vectors related to "showing (and creating) the PDF certificates.". EPSS estimates a 0.70% chance of exploitation in the next 30 days.
Description
The Certify module before 6.x-2.3 for Drupal does not properly perform node access checks, which allows remote authenticated users to bypass intended access restrictions and obtain sensitive PDF certificate information via vectors related to "showing (and creating) the PDF certificates."
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Certify Project | Certify | 6.x-2.2 |
References
- https://www.drupal.org/node/2415947Patch, Vendor Advisory
- https://www.drupal.org/node/2415947Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-3404?
How severe is CVE-2015-3404?
How do I fix CVE-2015-3404?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-3391The Path Breadcrumbs module before 7.x-3.2 for Drupal allows…
- CVE-2015-3392Cross-site scripting (XSS) vulnerability in the Ajax Timelin…
- CVE-2015-3393Open redirect vulnerability in the Commerce WeDeal module be…
- CVE-2015-3395The msrle_decode_pal4 function in msrledec.c in Libav before…
- CVE-2015-3397Cross-site scripting (XSS) vulnerability in Yii Framework be…
- CVE-2015-3400sharenfs 0.6.4, when built with commits bcdd594 and 7d08880 …
- CVE-2015-3405ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x befor…
- CVE-2015-3406The PGP signature parsing in Module::Signature before 0.74 a…7.5
- CVE-2015-3407Module::Signature before 0.74 allows remote attackers to byp…
- CVE-2015-3408Module::Signature before 0.74 allows remote attackers to exe…
- CVE-2015-3409Untrusted search path vulnerability in Module::Signature bef…
- CVE-2015-3411PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6…
Are you affected by CVE-2015-3404?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST