The Views module before 6.x-2.18, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to the default views configurations, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Views | Views_project | * | 6.x-2.16 (including) |
| Views | Views_project | 6.x-3.0 (including) | 6.x-3.0 (including) |
| Views | Views_project | 6.x-3.0-alpha1 (including) | 6.x-3.0-alpha1 (including) |
| Views | Views_project | 6.x-3.0-alpha2 (including) | 6.x-3.0-alpha2 (including) |
| Views | Views_project | 6.x-3.0-alpha3 (including) | 6.x-3.0-alpha3 (including) |
| Views | Views_project | 6.x-3.0-alpha4 (including) | 6.x-3.0-alpha4 (including) |
| Views | Views_project | 6.x-3.0-rc2 (including) | 6.x-3.0-rc2 (including) |
| Views | Views_project | 6.x-3.0-rc3 (including) | 6.x-3.0-rc3 (including) |
| Views | Views_project | 7.x-3.0 (including) | 7.x-3.0 (including) |
| Views | Views_project | 7.x-3.0-alpha1 (including) | 7.x-3.0-alpha1 (including) |
| Views | Views_project | 7.x-3.0-beta1 (including) | 7.x-3.0-beta1 (including) |
| Views | Views_project | 7.x-3.0-beta2 (including) | 7.x-3.0-beta2 (including) |
| Views | Views_project | 7.x-3.0-beta3 (including) | 7.x-3.0-beta3 (including) |
| Views | Views_project | 7.x-3.0-rc1 (including) | 7.x-3.0-rc1 (including) |
| Views | Views_project | 7.x-3.0-rc3 (including) | 7.x-3.0-rc3 (including) |
| Views | Views_project | 7.x-3.1 (including) | 7.x-3.1 (including) |
| Views | Views_project | 7.x-3.2 (including) | 7.x-3.2 (including) |
| Views | Views_project | 7.x-3.3 (including) | 7.x-3.3 (including) |
| Views | Views_project | 7.x-3.4 (including) | 7.x-3.4 (including) |
| Views | Views_project | 7.x-3.5 (including) | 7.x-3.5 (including) |
| Views | Views_project | 7.x-3.6 (including) | 7.x-3.6 (including) |
| Views | Views_project | 7.x-3.7 (including) | 7.x-3.7 (including) |
| Views | Views_project | 7.x-3.8 (including) | 7.x-3.8 (including) |
| Views | Views_project | 7.x-3.x-dev (including) | 7.x-3.x-dev (including) |
References
- http://www.openwall.com/lists/oss-security/2015/02/13/12
- https://www.drupal.org/node/2424097
- https://www.drupal.org/node/2424101
- https://www.drupal.org/node/2424103
- https://www.drupal.org/node/2424403
- http://www.openwall.com/lists/oss-security/2015/02/13/12
- https://www.drupal.org/node/2424097
- https://www.drupal.org/node/2424101
- https://www.drupal.org/node/2424103
- https://www.drupal.org/node/2424403