CVE-2010-2353
Status: ModifiedMedium (5)—
The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes.
CVSS
- Version: 2.0
- Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
- Base score: 5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.77%
- Percentile among all scored CVEs: 77
- Score date: 10/4/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-264
References
- http://drupal.org/node/829566
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html
- http://osvdb.org/65615
- http://secunia.com/advisories/40243
- http://secunia.com/advisories/40318
- http://www.vupen.com/english/advisories/2010/1546
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59515
- http://drupal.org/node/829566
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html
- http://osvdb.org/65615
- http://secunia.com/advisories/40243
- http://secunia.com/advisories/40318
- http://www.vupen.com/english/advisories/2010/1546
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59515
Raw JSON (NVD)
Show
{
"id": "CVE-2010-2353",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2010-06-21T19:30:02.180",
"references": [
{
"url": "http://drupal.org/node/829566",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html",
"source": "cve@mitre.org"
},
{
"url": "http://osvdb.org/65615",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/40243",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/40318",
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2010/1546",
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515",
"source": "cve@mitre.org"
},
{
"url": "http://drupal.org/node/829566",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://osvdb.org/65615",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/40243",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/40318",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2010/1546",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-264"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes."
},
{
"lang": "es",
"value": "El módulo \"Node Reference\" (referencia de nodo) en el módulo \"Content Construction Kit\" (CCK o kit de construcción de contenido) v6.x en versiones anteriores a la v6.x-2.7 para Drupal no realiza comprobaciones de acceso para el campo \"source\" (fuente) en la URL de administración para la funcionalidad autocompletar (autocomplete widget), lo que permite a atacantes remotos descubrir títulos e IDs de los nodos controlados.\r\n"
}
],
"lastModified": "2026-06-16T23:20:36.143",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-1.0-alpha:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8CE8ED07-644D-4B7A-9D25-31846C73B16C"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-1.x-dev:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "894AAB4C-0687-49FF-80D2-07733232C86E"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9981BCE7-4563-4B81-94D7-E15CC7A949C0"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4DE0DF1B-BD55-4BE0-82E5-D6C8F4DB0ED2"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7212E3AC-0707-4C73-BCB8-ECB387621371"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1CBF8E73-7EBC-400E-8045-C89A2400C346"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F091E8C8-ECB2-4CC9-A692-DFD50FAFE0D3"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5C2D28B8-26B4-4965-95A5-F2CE0CE6C897"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1B76DBD4-1AAB-4B2D-AC67-606CD9FD6209"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B25EE03-5D36-499A-BA45-C5FDD09144DE"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3A7B8CE-4D89-40E3-8717-9CA43CA227DD"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6E6A0133-B19E-4C9F-ACD3-DBC327722B28"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A2675E82-5546-405A-B1E8-2B656E49A903"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7AF2DABF-D278-4AC4-B1A1-4CA5E6782695"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "64EA01B6-78C1-4244-8E9E-3E38F99A9C58"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5A8FFBDF-CC67-409C-9AA4-965998EE1D5F"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "325695A4-AC8F-42E3-A817-C39D002DBCB9"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "54D00828-64FD-4068-8CD7-04D2BCE5AC84"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13EDA2FA-C962-4F58-BA3D-9F8FFF801D9C"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1F8EA159-92F4-4CEA-A117-0BFD07179357"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.x-dev:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "578E1219-B38F-4166-923D-FC48E8558707"
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-3.x-dev:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8FC11CA-4FEB-4593-A43F-5711E5611D6D"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}