CVE-2008-1729 | BDVDB-2026-30171 Detail

Description#

The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to (1) edit the profile pages of arbitrary users, and obtain sensitive information from (2) tracker and (3) blog pages, related to a missing check for the "access content" permission; and (4) allows remote authenticated users, with administration page view access, to edit content types.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://secunia.com/advisories/29762
http://www.osvdb.org/44270
http://drupal.org/node/244637
https://exchange.xforce.ibmcloud.com/vulnerabilities/41755
http://www.securityfocus.com/bid/28714
http://www.vupen.com/english/advisories/2008/1185/references

Exploit#

No public exploit known

History#

Version 12008-04-11Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.