CVE-2015-5502

critical

Description

The Storage API module 7.x-1.x before 7.x-1.8 for Drupal does not properly restrict access to Storage API fields attached to entities that are not nodes, which allows remote attackers to have unspecified impact via unknown vectors.

References

https://www.drupal.org/node/2495903

https://www.drupal.org/node/2495895

http://www.securityfocus.com/bid/74867

http://www.openwall.com/lists/oss-security/2015/07/04/4

Details

Source: Mitre, NVD

Published: 2015-08-18

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.00647

Detections

Analytics