CVE-2015-5498: Shipwire API Project Shipwire API

Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days.

The Shipwire API module 7.x-1.x before 7.x-1.03 for Drupal does not check the view permission for the shipments overview (admin/shipwire/shipments), which allows remote attackers to obtain sensitive information via a request to the page.

Affected products

• Shipwire API Project Shipwire API: version 7.x-1.0 only; version 7.x-1.01 only; version 7.x-1.02 only

Published 2015-08-18. Last modified 2026-06-17.