CVE-2014-3704
Scores
EPSS Score
0.9440
CVSS
3.x 0.0
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
All CVSS Scores
CVSS 4.0
0.0CVSS 3.x
0.0CVSS 2.0
7.5Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
Sources
debiannvdubuntu
CWEs
CWE-89
Exploits
Reference Links
Vulnerable Software
Type: Configuration
Product: drupal6
Operating System: debian
Trait:
{
"unaffected": true
}Source: debian
Type: Configuration
Product: drupal7
Operating System: ubuntu trusty 14.04
Trait:
{
"fixed": "7.26-1ubuntu0.1"
}Source: ubuntu
Type: Configuration
Product: drupal7
Operating System: debian
Trait:
{
"fixed": "7.32-1"
}Source: debian
Type: Configuration
Vendor: debian
Product: debian_linux
Operating System: * * *
Trait:
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"operator": "OR"
}Source: nvd
Type: Configuration
Vendor: drupal
Product: drupal
Operating System: * * *
Trait:
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.32",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"operator": "OR"
}Source: nvd