CVE-2013-1973

Vulnerability

The Autocomplete Widgets for Text and Number Fields (autocomplete_widgets) module for Drupal 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-rc1 contains an access bypass vulnerability in its autocomplete callback [1][3]. The callback does not properly check node permissions before returning field values, allowing sensitive information to be retrieved by unauthorized users [3]. Versions affected: Autocomplete Widgets 6.x-1.x prior to 6.x-1.4, and 7.x-1.x prior to 7.x-1.0-rc1 [3].

Exploitation

An attacker must have a Drupal role that grants permission to create or edit content [3]. The attacker can then trigger the autocomplete callback on a node field they are not authorized to view, and the callback will return field values without enforcing node access control [3]. No special network position is required; the attack is performed through normal Drupal HTTP requests.

Impact

A remote authenticated attacker can obtain sensitive field values from nodes they should not be able to access [3]. This results in unauthorized information disclosure, potentially exposing confidential data stored in text or number fields. The attacker does not need to interact with other users, and the attack does not require any race window or write access [3].

Mitigation

Users should upgrade to the latest fixed versions: Autocomplete Widgets 6.x-1.4 for Drupal 6.x, or Autocomplete Widgets 7.x-1.0-rc1 for Drupal 7.x [3][4]. These releases were published on 16 April 2013 [2][4]. There is no known workaround for sites that cannot immediately upgrade. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of its publication date.