CVE-2015-5490

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-08-18 · updated 2026-06-17
Weakness: CWE-200

Description

The _views_fetch_data method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache if the static cache is not empty, which allows remote attackers to bypass intended filters and obtain access to hidden content via unspecified vectors.

Affected products

Views Project Views: 7.x-3.5, 7.x-3.6, 7.x-3.7, 7.x-3.8, 7.x-3.10

References

http://cgit.drupalcode.org/views/commit/?id=cef693b
http://www.openwall.com/lists/oss-security/2015/07/04/4
http://www.securityfocus.com/bid/74462
https://www.drupal.org/node/2475669
https://www.drupal.org/node/2480259
https://www.drupal.org/node/2480327
http://cgit.drupalcode.org/views/commit/?id=cef693b
http://www.openwall.com/lists/oss-security/2015/07/04/4
http://www.securityfocus.com/bid/74462
https://www.drupal.org/node/2475669
https://www.drupal.org/node/2480259
https://www.drupal.org/node/2480327

Get alerted when CVE-2015-5490 or the next vulnerability affects your stack