PT-2008-3270 · Drupal · Drupal

Publicado 2008-04-11 · Atualizado 2021-04-19 · CVE-2008-1729

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 6.2

Description The issue affects the menu system, allowing remote attackers to edit profile pages of arbitrary users and obtain sensitive information from tracker and blog pages due to a missing check for the access content permission. Additionally, remote authenticated users with administration page view access can edit content types.

Recommendations For versions prior to 6.2, update to version 6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to administration pages and sensitive user information until the update can be applied.

Correção

Identificadores relacionados

CVE-2008-1729

Produtos afetados

Drupal

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/41755 · Nota
• http://vupen.com/english/advisories/2008/1185/references · Nota
• http://drupal.org/node/244637 · Aviso do Fabricante
• http://securityfocus.com/bid/28714 · Correção
• http://secunia.com/advisories/29762 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1729 · Nota
• http://osvdb.org/44270 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1729 · Nota de Segurança