CVE-2014-5179 : The freelinking module for Drupal, as used in the Freelinking for Case Tracker module, does not properly check access pe

The freelinking module for Drupal, as used in the Freelinking for Case Tracker module, does not properly check access permissions for (1) nodes or (2) users, which allows remote attackers to obtain sensitive information via a crafted link.

Published 2014-08-06 18:55:06

Updated 2017-09-08 01:29:04

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2014-5179

EPSS FAQ

0.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 63 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-5179

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

References for CVE-2014-5179

http://www.securityfocus.com/bid/68861

Drupal Freelinking And Freelinking Case Tracker Modules Security Bypass Vulnerability
https://www.drupal.org/node/2308503

SA-CONTRIB-2014-072 - Freelinking, Freelinking Case Tracker - Access bypass | Drupal.org
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/94870

Freelinking module for Drupal Case Tracker security bypass CVE-2014-5179 Vulnerability Report

Products affected by CVE-2014-5179

Freelinking Project » Freelinking » Version: N/A For Drupal
cpe:2.3:a:freelinking_project:freelinking:-:*:*:*:*:drupal:*:*
Matching versions
Freelinking For Case Tracker Project » Freelinking For Case Tracker » Version: N/A For Drupal
cpe:2.3:a:freelinking_for_case_tracker_project:freelinking_for_case_tracker:-:*:*:*:*:drupal:*:*
Matching versions

Vulnerability Details : CVE-2014-5179

Exploit prediction scoring system (EPSS) score for CVE-2014-5179

CVSS scores for CVE-2014-5179

CWE ids for CVE-2014-5179

References for CVE-2014-5179

Products affected by CVE-2014-5179