fkie_cve-2009-4515
Vulnerability from fkie_nvd
Published
2009-12-31 19:30
Modified
2025-04-09 00:30
Severity ?
Summary
The Storm module 6.x before 6.x-1.25 for Drupal does not enforce privilege requirements for storminvoiceitem nodes, which allows remote attackers to read node titles via unspecified vectors.
References
cve@mitre.orghttp://drupal.org/node/617480Patch
cve@mitre.orghttp://drupal.org/node/617494Patch, Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/37202Vendor Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/36879
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/3090Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://drupal.org/node/617480Patch
af854a3a-2127-422b-91ae-364da2661108http://drupal.org/node/617494Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/37202Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/36879
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/3090Vendor Advisory
Impacted products
Vendor Product Version
speedtech storm 6.x-1.0
speedtech storm 6.x-1.1
speedtech storm 6.x-1.2
speedtech storm 6.x-1.3
speedtech storm 6.x-1.4
speedtech storm 6.x-1.5
speedtech storm 6.x-1.6
speedtech storm 6.x-1.7
speedtech storm 6.x-1.8
speedtech storm 6.x-1.9
speedtech storm 6.x-1.10
speedtech storm 6.x-1.11
speedtech storm 6.x-1.12
speedtech storm 6.x-1.13
speedtech storm 6.x-1.14
speedtech storm 6.x-1.15
speedtech storm 6.x-1.16
speedtech storm 6.x-1.17
speedtech storm 6.x-1.18
speedtech storm 6.x-1.19
speedtech storm 6.x-1.20
speedtech storm 6.x-1.21
speedtech storm 6.x-1.22
speedtech storm 6.x-1.23
speedtech storm 6.x-1.24
speedtech storm 6.x-1.x
drupal drupal *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "43E635EA-61AC-40A4-8288-73E3E5FCE13E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "11A4BD8A-BFFE-44A2-AA57-CC81360899B7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "24D5FF1D-D6EE-4F15-B8E8-B41031D88477",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "733ED38A-A409-4E4E-BE2F-9B7B2C6C4FFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "54BBE17E-4AF9-4290-AC58-CCB9AE3A06AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF3B42E5-EB25-4117-B36F-59DE9C78D549",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E8954D9-44A9-4E71-822D-0A691E93EE3C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "66662533-AC69-4D65-933D-58168C7B75B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "716B8287-EF97-4738-9D4A-DB6C95212A9B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "86D011B0-9806-4195-93FE-303ACB24D234",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "2080F0BE-E4A8-445B-831C-D18489E95E48",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "57166D33-B6B0-47DE-9603-436F083F0393",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "A4B53D24-33A2-4630-8A7B-3DEB0A91B975",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D8E59A5-5CE4-4922-8368-E6FD0FBF87D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "C8D13A0F-E7A2-447A-AC78-A226C190BDFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "0914D667-3C7F-48CB-BF14-04109450B69F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C250B6F-304B-4BA6-B2C5-897A76E33762",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "D53C8B02-0D37-4BFF-87FD-618A88785309",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE1F5F72-265B-42C0-B665-0C219C594701",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D851C9E-FA2D-48B8-AB77-3E49B312348E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "19044A29-2043-4D6E-BA6E-C055994A746D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "3D324D19-629A-4512-9714-2EBE85FFBFA6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4286A4F-BFBA-44F4-88E9-3976C0AE7928",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E68EDCB-AD88-4C88-B058-001BEB684131",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.24:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7AC535E-0ACB-4F0C-871E-8184991F6C53",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:speedtech:storm:6.x-1.x:dev:*:*:*:*:*:*",
              "matchCriteriaId": "6939DD1F-D81F-4589-A07B-967FBFACB7BC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Storm module 6.x before 6.x-1.25 for Drupal does not enforce privilege requirements for storminvoiceitem nodes, which allows remote attackers to read node titles via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "El m\u00f3dulo Storm v6.x anterior a v6.x-1.25 para Drupal, no refuerza los requisitos de privilegios para los nodos storminvoiceitem; esto permite a atacantes remotos leer los t\u00edtulos de los nodos a trav\u00e9s de vectores no especificados."
    }
  ],
  "id": "CVE-2009-4515",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-12-31T19:30:00.297",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://drupal.org/node/617480"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://drupal.org/node/617494"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/37202"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/36879"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/3090"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://drupal.org/node/617480"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://drupal.org/node/617494"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/37202"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/36879"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/3090"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.