CVE-2015-7306

EUVD-2015-7235
The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated users to access and change settings by leveraging the "access administration pages" permission.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.9 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:S/C:N/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 48%
Affected Products (NVD)
VendorProductVersion
drupaldisecms_updater
7.x-1.0:x
drupaldisecms_updater
7.x-1.1:x
drupaldisecms_updater
7.x-1.2:x
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.drupal.org/node/2569111
https://www.drupal.org/node/2569599
https://www.drupal.org/node/2569111
https://www.drupal.org/node/2569599