CVE-2015-7229
Severity CVSS v4.0:
Pending analysis
Type:
CWE-264
Permissions, Privileges, and Access Control
Publication date:
17/09/2015
Last modified:
12/04/2025
Description
The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the (1) "post to twitter" permission or change the options for arbitrary attached accounts by leveraging the (2) "add twitter accounts" or (3) "add authenticated twitter accounts" permission.
Impact
Base Score 2.0
3.50
Severity 2.0
LOW
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:twitter_project:twitter:6.x-5.0:*:*:*:*:drupal:*:* | ||
| cpe:2.3:a:twitter_project:twitter:6.x-5.1:*:*:*:*:drupal:*:* | ||
| cpe:2.3:a:twitter_project:twitter:6.x-5.x:dev:*:*:*:drupal:*:* | ||
| cpe:2.3:a:twitter_project:twitter:7.x-5.0:*:*:*:*:drupal:*:* | ||
| cpe:2.3:a:twitter_project:twitter:7.x-5.1:*:*:*:*:drupal:*:* | ||
| cpe:2.3:a:twitter_project:twitter:7.x-5.2:*:*:*:*:drupal:*:* | ||
| cpe:2.3:a:twitter_project:twitter:7.x-5.3:*:*:*:*:drupal:*:* | ||
| cpe:2.3:a:twitter_project:twitter:7.x-5.4:*:*:*:*:drupal:*:* | ||
| cpe:2.3:a:twitter_project:twitter:7.x-5.5:*:*:*:*:drupal:*:* | ||
| cpe:2.3:a:twitter_project:twitter:7.x-5.6:*:*:*:*:drupal:*:* | ||
| cpe:2.3:a:twitter_project:twitter:7.x-5.7:*:*:*:*:drupal:*:* | ||
| cpe:2.3:a:twitter_project:twitter:7.x-5.8:*:*:*:*:drupal:*:* | ||
| cpe:2.3:a:twitter_project:twitter:7.x-6.0:alpha1:*:*:*:drupal:*:* | ||
| cpe:2.3:a:twitter_project:twitter:7.x-6.0:alpha2:*:*:*:drupal:*:* |
To consult the complete list of CPE names with products and versions, see this page