CVE-2015-7226

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-09-17 · updated 2026-06-17
Weakness: CWE-200

Description

The Administration Views module 7.x-1.x before 7.x-1.5 for Drupal checks access permissions based on the router path from the view instead of the display property, which allows remote attackers to obtain sensitive information via vectors related to the access handler.

Affected products

Administration Views Project Administration Views: 7.x-1.0, 7.x-1.0-rc1, 7.x-1.1, 7.x-1.2, 7.x-1.3, 7.x-1.4 (+1)

References

http://cgit.drupalcode.org/admin_views/commit/?id=44098bb
http://www.securityfocus.com/bid/75697
https://www.drupal.org/node/2529366
https://www.drupal.org/node/2529378
http://cgit.drupalcode.org/admin_views/commit/?id=44098bb
http://www.securityfocus.com/bid/75697
https://www.drupal.org/node/2529366
https://www.drupal.org/node/2529378

Get alerted when CVE-2015-7226 or the next vulnerability affects your stack