CVEvulnerability
CVE-2005-3974
6.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2005-12-03
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
Description
Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission.
Affected configurations
• drupal drupal 4.5
• drupal drupal 4.5.1
• drupal drupal 4.5.2
• drupal drupal 4.5.3
• drupal drupal 4.5.4
• drupal drupal 4.5.5
• drupal drupal 4.6
• drupal drupal 4.6.1
• drupal drupal 4.6.2
• drupal drupal 4.6.3
References
- http://drupal.org/files/sa-2005-009/4.6.3.patch Patch
- http://drupal.org/files/sa-2005-009/advisory.txt Vendor Advisory
- http://secunia.com/advisories/17824 Patch, Vendor Advisory
- http://secunia.com/advisories/18630 Patch, Vendor Advisory
- http://www.debian.org/security/2006/dsa-958 Patch, Vendor Advisory
- http://www.securityfocus.com/archive/1/418336/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/15674 Patch
- http://www.vupen.com/english/advisories/2005/2684 www.vupen.com
- http://drupal.org/files/sa-2005-009/4.6.3.patch Patch
- http://drupal.org/files/sa-2005-009/advisory.txt Vendor Advisory
- http://secunia.com/advisories/17824 Patch, Vendor Advisory
- http://secunia.com/advisories/18630 Patch, Vendor Advisory
- http://www.debian.org/security/2006/dsa-958 Patch, Vendor Advisory
- http://www.securityfocus.com/archive/1/418336/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/15674 Patch
- http://www.vupen.com/english/advisories/2005/2684 www.vupen.com