CVEvulnerability
CVE-2008-1729
5.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-04-11
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
Description
The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to (1) edit the profile pages of arbitrary users, and obtain sensitive information from (2) tracker and (3) blog pages, related to a missing check for the "access content" permission; and (4) allows remote authenticated users, with administration page view access, to edit content types.
Affected configurations
• drupal drupal (>= 6.0 < 6.2)
References
- http://drupal.org/node/244637 Patch, Vendor Advisory
- http://secunia.com/advisories/29762 Third Party Advisory
- http://www.osvdb.org/44270 Broken Link
- http://www.securityfocus.com/bid/28714 Patch, Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2008/1185/references Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41755 Third Party Advisory, VDB Entry
- http://drupal.org/node/244637 Patch, Vendor Advisory
- http://secunia.com/advisories/29762 Third Party Advisory
- http://www.osvdb.org/44270 Broken Link
- http://www.securityfocus.com/bid/28714 Patch, Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2008/1185/references Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41755 Third Party Advisory, VDB Entry