LiveActive security incident?Get immediate response
CVE Record

CVE-2015-7229: The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal do...

The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the (1) "post to twitter" permission or change the options for arbitrary attached accounts by leveraging the (2) "add twitter accounts" or (3) "add authenticated twitter accounts" permission.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This affects Drupal sites using vulnerable versions of the Twitter module. Authenticated users with certain Twitter-related permissions could misuse the module to post tweets through accounts they should not control, or alter options for attached accounts. The main risk is unauthorized social posting and brand or communications damage, not server compromise.

Executive priority

Prioritize remediation where Drupal is connected to corporate or customer-facing Twitter accounts. This is a reputation and communications integrity issue, especially if many non-admin users have Twitter module permissions.

Technical view

The Drupal Twitter module failed to properly enforce access permissions in listed 6.x and 7.x branches. A remote authenticated user with "post to twitter" could post to arbitrary accounts; users with "add twitter accounts" or "add authenticated twitter accounts" could change options for arbitrary attached accounts.

Likely exposure

Exposure is likely limited to Drupal deployments that installed the Twitter module versions 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, or 7.x-6.x before 7.x-6.0 and granted the named permissions to users.

Exploitation context

The provided sources do not show KEV listing or active exploitation. Exploitation requires an authenticated user and relevant module permissions, but could affect arbitrary attached Twitter accounts once those conditions exist.

Researcher notes

Evidence is limited to the CVE description and Drupal.org references in the bundle. No CVSS, CWE, exploit details, or KEV status supporting active exploitation were provided. Focus validation on module version, role permissions, and attached account control boundaries.

Mitigation direction

  • Upgrade the Drupal Twitter module to the fixed branch version or later named by the CVE.
  • Review Drupal.org guidance linked for the affected module branches.
  • Restrict "post to twitter" permission to trusted roles only.
  • Restrict "add twitter accounts" and "add authenticated twitter accounts" to administrators.
  • Audit attached Twitter accounts for unexpected configuration or posts.

Validation and detection

  • Inventory Drupal sites using the Twitter module.
  • Confirm installed module versions against the vulnerable branch ranges.
  • Review role assignments for the three named Twitter permissions.
  • Check attached Twitter account settings for unauthorized changes.
  • Review recent social posts for unexpected activity from Drupal-connected accounts.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2015-7229 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.