CVE-2015-4375
Last modified
CVE-2015-4375 is a vulnerability of currently unknown severity. The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an autocomplete search on custom entities without an access query tag or (2) leveraging knowledge of the ID of an entity.. EPSS estimates a 1.23% chance of exploitation in the next 30 days.
Description
The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an autocomplete search on custom entities without an access query tag or (2) leveraging knowledge of the ID of an entity.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Chaos Tool Suite Project | Ctools | 7.x-1.0 |
| Chaos Tool Suite Project | Ctools | 7.x-1.1 |
| Chaos Tool Suite Project | Ctools | 7.x-1.2 |
| Chaos Tool Suite Project | Ctools | 7.x-1.3 |
| Chaos Tool Suite Project | Ctools | 7.x-1.4 |
| Chaos Tool Suite Project | Ctools | 7.x-1.5 |
| Chaos Tool Suite Project | Ctools | 7.x-1.6 |
References
- https://www.drupal.org/node/2454909Patch, Vendor Advisory
- https://www.drupal.org/node/2454909Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-4375?
How severe is CVE-2015-4375?
How do I fix CVE-2015-4375?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-4369Cross-site scripting (XSS) vulnerability in the Trick Questi…
- CVE-2015-4370Cross-site scripting (XSS) vulnerability in the Site Documen…
- CVE-2015-4371Open redirect vulnerability in the Perfecto module before 7.…
- CVE-2015-4372Cross-site scripting (XSS) vulnerability in the Image Title …
- CVE-2015-4373Cross-site scripting (XSS) vulnerability in the OG tabs modu…
- CVE-2015-4374Cross-site scripting (XSS) vulnerability in the Webform modu…
- CVE-2015-4376Cross-site scripting (XSS) vulnerability in the Profile2 Pri…
- CVE-2015-4377Cross-site scripting (XSS) vulnerability in unspecified admi…
- CVE-2015-4378Cross-site scripting (XSS) vulnerability in the Crumbs modul…
- CVE-2015-4379Cross-site request forgery (CSRF) vulnerability in the Webfo…
- CVE-2015-4380Cross-site scripting (XSS) vulnerability in the Linear Case …
- CVE-2015-4381Cross-site scripting (XSS) vulnerability in the Invoice modu…
Are you affected by CVE-2015-4375?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST