PT-2008-3272 · Drupal · Drupal Simple Access

Published 2008-04-11 · Updated 2017-08-08 · CVE-2008-1731

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal Simple Access module versions 5.x through 5.x-1.2-2

Description The issue is related to the handling of privacy information for nodes, potentially allowing remote attackers to bypass access restrictions and read or modify nodes under certain circumstances involving the interaction between the Simple Access module and other components like Node clone or Project issue tracking.

Recommendations For versions 5.x through 5.x-1.2-2, update the Simple Access module to a version that properly handles node privacy information to prevent unauthorized access.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-1731

Affected Products

Drupal Simple Access

References · 7

• http://securityfocus.com/bid/28720 · Patch
• http://secunia.com/advisories/29772 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1731 · Security Note
• http://drupal.org/node/244560 · Vendor Advisory
• http://osvdb.org/44271 · Note
• http://vupen.com/english/advisories/2008/1184 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41756 · Note