PT-2008-3270 · Drupal · Drupal

Published 2008-04-11 · Updated 2021-04-19 · CVE-2008-1729

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 6.2

Description The issue affects the menu system, allowing remote attackers to edit profile pages of arbitrary users and obtain sensitive information from tracker and blog pages due to a missing check for the access content permission. Additionally, remote authenticated users with administration page view access can edit content types.

Recommendations For versions prior to 6.2, update to version 6.2 or later to resolve the issue. As a temporary workaround, consider restricting access to administration pages and sensitive user information until the update can be applied.

Fix

Related Identifiers

CVE-2008-1729

Affected Products

Drupal

References · 8

• http://drupal.org/node/244637 · Vendor Advisory
• http://securityfocus.com/bid/28714 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-1729 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41755 · Note
• http://vupen.com/english/advisories/2008/1185/references · Note
• http://secunia.com/advisories/29762 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1729 · Note
• http://osvdb.org/44270 · Note