CVE-2014-9154

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-12-01 · updated 2026-06-17
Weakness: CWE-200

Description

The Notify module 7.x-1.x before 7.x-1.1 for Drupal does not properly restrict access to (1) new or (2) modified nodes or (3) their fields, which allows remote authenticated users to obtain node titles, teasers, and fields by reading a notification email.

Affected products

Notify Project Notify: 7.x-1.0, 7.x-1.0-alpha1, 7.x-1.0-alpha2, 7.x-1.0-alpha3, 7.x-1.0-alpha4, 7.x-1.0-alpha5 (+6)

References

https://www.drupal.org/node/2320693
https://www.drupal.org/node/2320741
https://www.drupal.org/node/2320693
https://www.drupal.org/node/2320741

Get alerted when CVE-2014-9154 or the next vulnerability affects your stack