« Volver al listado

CVE-2015-4394

Estado: ModificadaMedia (5)—

The Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote attackers to bypass the field_access restriction and obtain sensitive private field information via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Services Project — Services

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-4394",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-06-15T14:59:48.917",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/04/25/6",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/74365",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.drupal.org/node/2471847",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.drupal.org/node/2471879",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/04/25/6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/74365",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.drupal.org/node/2471847",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.drupal.org/node/2471879",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote attackers to bypass the field_access restriction and obtain sensitive private field information via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "El módulo Services 7.x-3.x anterior a 7.x-3.12 para Drupal permite a atacantes remotos evadir la restricción field_access y obtener información sensible de campos privados a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-17T00:27:13.473",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:services_project:services:7.x-3.0:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8507487C-B934-480A-8D10-24C371D46EFF"
            },
            {
              "criteria": "cpe:2.3:a:services_project:services:7.x-3.1:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC965146-8BA9-4786-B2D7-0A63DBFFB022"
            },
            {
              "criteria": "cpe:2.3:a:services_project:services:7.x-3.2:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7584BE36-CA24-4566-8982-DEAA90FFE059"
            },
            {
              "criteria": "cpe:2.3:a:services_project:services:7.x-3.3:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "002452ED-3758-4D10-8B23-63B632CEFF1B"
            },
            {
              "criteria": "cpe:2.3:a:services_project:services:7.x-3.4:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "96926BC8-2502-4EFB-BAD2-B03DB002848D"
            },
            {
              "criteria": "cpe:2.3:a:services_project:services:7.x-3.5:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F46C1136-EEB4-472A-AC91-901987EABA1D"
            },
            {
              "criteria": "cpe:2.3:a:services_project:services:7.x-3.6:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B08C1A4-D8C0-42F4-B233-455E178135D5"
            },
            {
              "criteria": "cpe:2.3:a:services_project:services:7.x-3.7:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E50876CA-C0A2-4EAA-8D7C-F539107C5450"
            },
            {
              "criteria": "cpe:2.3:a:services_project:services:7.x-3.10:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "629A80BC-4A13-492F-BF1D-9D37CB9D6CE5"
            },
            {
              "criteria": "cpe:2.3:a:services_project:services:7.x-3.11:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67475426-C059-41B2-B80E-42A03EBD8AAF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}