« Volver al listado

CVE-2012-4471

Estado: ModificadaMedia (5)—

The Search Autocomplete module 7.x-2.x before 7.x-2.4 for Drupal does not properly restrict access to the module admin page, which allows remote attackers to disable an autocompletion or change the priority order via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dominique Clause — Search Autocomplete

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-4471",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": true,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-11-30T22:55:00.987",
  "references": [
    {
      "url": "http://drupal.org/node/1649442",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://drupal.org/node/1679422",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/10/04/3",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/54379",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://drupal.org/node/1649442",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/1679422",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/10/04/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/54379",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Search Autocomplete module 7.x-2.x before 7.x-2.4 for Drupal does not properly restrict access to the module admin page, which allows remote attackers to disable an autocompletion or change the priority order via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "El módulo de Autocompletar Búsqueda (\"Search Autocomplete\") v7.x-2.x antes de v7.x-2.4 para Drupal no restringe adecuadamente el acceso a la página de administración del módulo, lo que permite a atacantes remotos deshabilitar el autocompletado o cambiar el orden de prioridad a través de vectores no especificados.\r\n"
    }
  ],
  "lastModified": "2026-06-16T23:45:09.807",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dominique_clause:search_autocomplete:7.x-2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50192C83-466E-4E22-96ED-44B4A07A1AC9"
            },
            {
              "criteria": "cpe:2.3:a:dominique_clause:search_autocomplete:7.x-2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C15532F7-D727-455E-9572-FCC485B7C150"
            },
            {
              "criteria": "cpe:2.3:a:dominique_clause:search_autocomplete:7.x-2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21AEA84C-16EF-4CA8-B8AC-4E72F44E09B6"
            },
            {
              "criteria": "cpe:2.3:a:dominique_clause:search_autocomplete:7.x-2.x:dev:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C42CD22-7542-4A0B-BAE7-01E357EA0A90"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F8B1170D-AD33-4C7A-892D-63AC71B032CF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}