CVE-2012-1635 | BDVDB-2026-51919 Detail

Description#

The hook_node_access function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks the permissions of the current user even when it is called to check permissions of other users, which allows remote attackers to bypass intended access restrictions, as demonstrated when using the XML sitemap module to obtain sensitive information about unpublished content.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://drupal.org/node/1407456
https://drupal.org/node/1409268
http://www.openwall.com/lists/oss-security/2012/04/07/1

Exploit#

No public exploit known

History#

Version 12012-08-28Record published in the CVE List.
Version 22024-09-16Most recent update recorded in the CVE List.