CVEvulnerability
CVE-2008-4792
6.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-10-29
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values.
Affected configurations
• drupal drupal (>= 5.0 < 5.11)
• drupal drupal (>= 6.0 < 6.5)
Related
Weakness · not in database (1)
References
- http://drupal.org/node/318706 Patch, Vendor Advisory
- http://secunia.com/advisories/32201 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2008/10/21/7 Mailing List, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45761 Third Party Advisory, VDB Entry
- http://drupal.org/node/318706 Patch, Vendor Advisory
- http://secunia.com/advisories/32201 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2008/10/21/7 Mailing List, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45761 Third Party Advisory, VDB Entry