PT-2008-6002 · Drupal · Drupal

Hanno Böck · Published 2008-10-29 · Updated 2018-11-02 · CVE-2008-4792

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal versions 5.x prior to 5.11 Drupal versions 6.x prior to 6.5

Description The issue arises from improper validation of unspecified content fields in an internal Drupal form within the core BlogAPI module. This allows remote authenticated users to bypass intended access restrictions by modifying field values.

Recommendations For Drupal 5.x, update to version 5.11 or later. For Drupal 6.x, update to version 6.5 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-4792

Affected Products

Drupal

References · 6

• http://drupal.org/node/318706 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4792 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45761 · Note
• http://secunia.com/advisories/32201 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4792 · Note
• http://openwall.com/lists/oss-security/2008/10/21/7 · Note