CVE-2015-7875

high-risk

Published 2017-08-07

ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on Panels and similar systems to place content and functionality on a page.

Do I need to act?

0.27% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (20)

Ctools

Affected Vendors

Chaos Tool Suite Project

References (6)

Mailing List http://www.openwall.com/lists/oss-security/2015/10/21/2

http://www.securityfocus.com/bid/76441

Vendor Advisory https://www.drupal.org/node/2554145

Mailing List http://www.openwall.com/lists/oss-security/2015/10/21/2

http://www.securityfocus.com/bid/76441

Vendor Advisory https://www.drupal.org/node/2554145

/ 100

high-risk

Severity 26/34 · High

Exploitability 1/34 · Minimal

Exposure 24/34 · High