« Volver al listado

CVE-2015-5490

Estado: ModificadaMedia (5)—

The _views_fetch_data method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache if the static cache is not empty, which allows remote attackers to bypass intended filters and obtain access to hidden content via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Views Project — Views

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-5490",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": true,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-08-18T17:59:31.833",
  "references": [
    {
      "url": "http://cgit.drupalcode.org/views/commit/?id=cef693b",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/07/04/4",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/74462",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.drupal.org/node/2475669",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.drupal.org/node/2480259",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.drupal.org/node/2480327",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://cgit.drupalcode.org/views/commit/?id=cef693b",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/07/04/4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/74462",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.drupal.org/node/2475669",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.drupal.org/node/2480259",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.drupal.org/node/2480327",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The _views_fetch_data method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache if the static cache is not empty, which allows remote attackers to bypass intended filters and obtain access to hidden content via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el método _views_fetch_data en includes/cache.inc en el módulo Views 7.x-3.5 hasta 7.x-3.10 para Drupal, no reconstruye la caché completa si la caché estática no está vacía, lo que permite a atacantes remotos eludir los filtros previstos y obtener acceso a contenido oculto a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-17T00:29:12.947",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:views_project:views:7.x-3.5:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "15890CE7-5208-4DD1-BCAC-2809091145D2"
            },
            {
              "criteria": "cpe:2.3:a:views_project:views:7.x-3.6:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D7AEF4E-57D4-4126-B013-0E9EA29F1875"
            },
            {
              "criteria": "cpe:2.3:a:views_project:views:7.x-3.7:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "013171AE-1195-496C-AF2E-450DA98A2D60"
            },
            {
              "criteria": "cpe:2.3:a:views_project:views:7.x-3.8:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1D695A3-33F1-4E15-BA91-AF7A3C153D16"
            },
            {
              "criteria": "cpe:2.3:a:views_project:views:7.x-3.10:*:*:*:*:drupal:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17D783C7-6DC2-4113-BA1E-021162A302DE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}