CVE-2015-7306

The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated users to access and change settings by leveraging the "access administration pages" permission.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.9 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:S/C:N/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
VendorProductVersion
drupaldisecms_updater
7.x-1.0:x
drupaldisecms_updater
7.x-1.1:x
drupaldisecms_updater
7.x-1.2:x
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.drupal.org/node/2569111
https://www.drupal.org/node/2569599
https://www.drupal.org/node/2569111
https://www.drupal.org/node/2569599