CVE-2010-2352

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-06-21 · updated 2026-06-16
Weakness: CWE-20

Description

The Node Reference module in Content Construction Kit (CCK) module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes.

Affected products

Karen Stevenson Cck: 5.x-1.0-beta, 5.x-1.1, 5.x-1.2, 5.x-1.3, 5.x-1.7, 5.x-1.x-dev (+17)
Yves Chedemois Cck: 5.x-1.4, 5.x-1.5, 5.x-1.6, 5.x-1.6-1, 5.x-1.8, 5.x-1.9 (+1)

References

http://drupal.org/node/829566
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html
http://osvdb.org/65615
http://secunia.com/advisories/40243
http://secunia.com/advisories/40318
http://www.vupen.com/english/advisories/2010/1546
https://exchange.xforce.ibmcloud.com/vulnerabilities/59515
http://drupal.org/node/829566
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html

Get alerted when CVE-2010-2352 or the next vulnerability affects your stack