« Volver al listado

CVE-2008-2771

Estado: ModificadaMedia (5)—

The Node Hierarchy module 5.x before 5.x-1.1 and 6.x before 6.x-1.0 for Drupal does not properly implement access checks, which allows remote attackers with "access content" permissions to bypass restrictions and modify the node hierarchy via unspecified attack vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Drupal — DrupalDrupal — Node Hierarchy Module

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-2771",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-06-18T22:41:00.000",
  "references": [
    {
      "url": "http://drupal.org/node/269473",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/30622",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/29675",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43006",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/269473",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/30622",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/29675",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43006",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Node Hierarchy module 5.x before 5.x-1.1 and 6.x before 6.x-1.0 for Drupal does not properly implement access checks, which allows remote attackers with \"access content\" permissions to bypass restrictions and modify the node hierarchy via unspecified attack vectors."
    },
    {
      "lang": "es",
      "value": "El módulo Node Hierarchy 5.x anterior a 5.x-1.1 y 6.x anteriores a 6.x-1.0 para Drupal no implementa adecuadamente los controles de acceso, lo que permite a atacantes remotos con permiso de \"acceso al contenido\", evitar las restricciones y modificar la jerarquía a través de vectores de ataque indeterminados.\r\n"
    }
  ],
  "lastModified": "2026-06-16T22:54:25.440",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDBE79A6-5762-4A7C-8FDA-C11FFFDCFC9B"
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FFE07AAD-9207-4C5F-A108-7F7753E4F48C"
            },
            {
              "criteria": "cpe:2.3:a:drupal:node_hierarchy_module:5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A90F9A0D-BD18-4E25-A5C1-58FAA916C659"
            },
            {
              "criteria": "cpe:2.3:a:drupal:node_hierarchy_module:6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD9CA485-B2C8-43F8-8053-A0EC8772E9BB"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}